diff --git a/.MetaTestOptIn.json b/.MetaTestOptIn.json
deleted file mode 100644
index 4c7c5a75d..000000000
--- a/.MetaTestOptIn.json
+++ /dev/null
@@ -1,5 +0,0 @@
-[
-    "Common Tests - Validate Module Files",
-    "Common Tests - Validate Markdown Files",
-    "Common Tests - Validate Script Files"
-]
diff --git a/.NuspecFileList.json b/.NuspecFileList.json
deleted file mode 100644
index 0358f500b..000000000
--- a/.NuspecFileList.json
+++ /dev/null
@@ -1,31 +0,0 @@
-[
-    {
-        "src": "PowerStig.psd1",
-        "target": ""
-    },
-    {
-        "src": "PowerStig.psm1",
-        "target": ""
-    },
-    {
-        "src": "README.md",
-        "target": ""
-    },
-    {
-        "src": "LICENSE*",
-        "target": ""
-    },
-    {
-        "src": "DSCResources\\**",
-        "target": "DSCResources\\"
-    },
-    {
-        "src": "StigData\\Processed\\**",
-        "target": "StigData\\Processed"
-    },
-    {
-        "src": "Module\\**\\*.*",
-        "target": "Module",
-        "exclude": "**\\Convert\\**"
-    }
-]
diff --git a/.codecov.yml b/.codecov.yml
deleted file mode 100644
index 29a05dd15..000000000
--- a/.codecov.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-codecov:
-  notify:
-    require_ci_to_pass: no
-
-comment:
-  layout: "reach, diff"
-  behavior: default
-
-coverage:
-  range: 50..80
-  round: down
-  precision: 0
-
-  status:
-    project:
-      default:
-        # Set the overall project code coverage requirement to 70%
-        target: 70
-    patch:
-      default:
-        # Set the pull request requirement to not regress overall coverage by more than 5%
-        # and let codecov.io set the goal for the code changed in the patch.
-        target: auto
-        threshold: 5
diff --git a/.gitignore b/.gitignore
index 4f3039eee..6265ce4e4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,15 @@
-# Cloned modules
-DSCResource.Tests
-
 # Editors
 .vscode/
 .vs/
 
 # local preference scripts/utilities
 .local/
+
+# Build output folder
+output/
+
+# Dynamic test folder where class inport code is stored
+.DynamicClassImport/
+
+# RequiredModules.psd1 is created by the build script and should be git ignored
+RequiredModules.psd1
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c60840a0..a3a472c38 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,24 @@
 # Versions
 
-## Unreleased
-
-## 4.3.0
+## [Unreleased]
+
+* Update PowerSTIG to successfully parse/apply MS SQL Server 2012 Instance Ver. 1 Rel. 20: [#639](https://github.com/microsoft/PowerStig/issues/639)
+* Update PowerSTIG to successfully parse/apply MS SQL Server 2016 Instance Ver. 1 Rel. 9: [#636](https://github.com/microsoft/PowerStig/issues/636)
+* Update PowerSTIG to successfully parse/apply Windows Server 2012 DNS STIG - Ver 1, Rel 14:  [#633](https://github.com/microsoft/PowerStig/issues/633)
+* Update PowerSTIG to successfully parse Microsoft IIS Server/Site 10.0 STIG STIG V1R1: [#632](https://github.com/microsoft/PowerStig/issues/632)
+* Update PowerSTIG to successfully parse Microsoft Visio 2013 STIG V1R4: [#629](https://github.com/microsoft/PowerStig/issues/629)
+* Update PowerSTIG to successfully parse/apply Windows Defender Antivirus STIG - V1R8: [#625](https://github.com/microsoft/PowerStig/issues/625)
+* Update PowerSTIG to successfully parse Microsoft SQL Server 2012 Database STIG V1R20: [#618](https://github.com/microsoft/PowerStig/issues/618)
+* Update PowerSTIG to successfully parse/apply Microsoft IIS Server/Site 8.5 STIG - Ver 1, Rel10: [#622](https://github.com/microsoft/PowerStig/issues/622)
+* Update PowerSTIG to use Azure Pipelines and DSC Community based build logic: [#600](https://github.com/microsoft/PowerStig/issues/600)
+* Update PowerSTIG to parse/convert the Vmware Vsphere 6.5 STIG V1R3: [#604](https://github.com/microsoft/PowerStig/issues/604)
+* Update PowerSTIG to parse/convert the Vmware Vsphere 6.5 STIG V1R4: [#634](https://github.com/microsoft/PowerStig/issues/634)
+* Fixed [#647](https://github.com/microsoft/PowerStig/issues/647): Conflict when configuring multiple databases
+* Fixed [#616](https://github.com/microsoft/PowerStig/issues/616): Unable to Import PowerSTIG 4.4.0 Due to cyclic dependency Error
+* Fixed [#632](https://github.com/microsoft/PowerStig/issues/632): Update PowerSTIG to allow for workgroup level scansr
+* Fixed [#652](https://github.com/microsoft/PowerStig/issues/652): Invalid ValueName for InternetExplorer11 rules V-75169 and V-75171
+
+## [4.3.0] - 2020-03-27
 
 * Update PowerSTIG to Expand .NET STIG Automation: [#591](https://github.com/microsoft/PowerStig/issues/591)
 * Update PowerSTIG to parse and apply McAfee VirusScan 8.8 Local Client STIG V5R16: [#588](https://github.com/microsoft/PowerStig/issues/588)
@@ -25,7 +41,7 @@
 * Fixed [#401](https://github.com/microsoft/PowerStig/issues/401): Checklists generated by New-StigChecklist do not provide finding details.
 * Fixed [#593](https://github.com/microsoft/PowerStig/issues/593): Update PowerSTIG Convert naming conventions of output STIGs
 
-## 4.2.0
+## [4.2.0] - 2019-12-20
 
 * Update PowerSTIG parsing for IIS 8.5 STIG - Ver 1, Rel 9: [#530](https://github.com/microsoft/PowerStig/issues/530)
 * Update PowerSTIG to successfully parse Microsoft .Net Framework STIG 4.0 STIG - Ver 1, Rel 9: [535](https://github.com/microsoft/PowerStig/issues/535)
@@ -45,18 +61,18 @@
 * Fixed [#545](https://github.com/microsoft/PowerStig/issues/545): Need a test to verify the conversionstatus="fail" does not exist in processed STIGs
 * Fixed [#517](https://github.com/microsoft/PowerStig/issues/520): Need a test to verify the module version in the module manifest matches the DscResources.
 
-## 4.1.1
+## [4.1.1] - 2019-10-31
 
 * Fixed [#517](https://github.com/microsoft/PowerStig/issues/517): 4.1.0 GPRegistryPolicyDsc Module Version Issue
 
-## 4.1.0
+## [4.1.0] - 2019-10-31
 
 * Update PowerSTIG to enable Exception Parameter Backward Compatibility Feature Request: [506](https://github.com/microsoft/PowerStig/issues/506)
 * Update Enable Stig Checklist automation to include Status and Comments for manual checks: [#485](https://github.com/microsoft/PowerStig/issues/485)
 
-## 4.0.0
+## [4.0.0] - 2019-09-23
 
-* Update PowerSTIG parsing for Windows Sever 2016 STIG - Ver 1, Rel 9 [#498] (https://github.com/microsoft/PowerStig/issues/498)
+* Update PowerSTIG parsing for Windows Sever 2016 STIG - Ver 1, Rel 9 [#498] - (https://github.com/microsoft/PowerStig/issues/498)
 * Fixed [#507](https://github.com/microsoft/PowerStig/issues/507): Get-HardCodedRuleLogFileEntry Errors on RegistryRule
 * Update PowerSTIG to leverage the GPRegistryPolicyDsc resource for Local Group Policy automation: [#497](https://github.com/microsoft/PowerStig/issues/497)
 * Update PowerSTIG to enable the logfile framework to consume a hashtable for HardCodedRule: [#494](https://github.com/microsoft/PowerStig/issues/494)
@@ -84,251 +100,3 @@
 * Updated logfile in DotNet Framework STIG leveraging HardCodedRule to automate additional STIG rules. [#454](https://github.com/microsoft/PowerStig/issues/454)
 * Fixed [#493](https://github.com/microsoft/PowerStig/issues/493): IIS 8/5 Server STIG rule V-76745 is referencing the incorrect IIS default path
 * Fixed [#505](https://github.com/microsoft/PowerStig/issues/505): Missing reg key setting on V-76759 IIS Server 8.5 v1R7
-
-## 3.3.0
-
-UPDATES
-
-* Fixed [#419](https://github.com/Microsoft/PowerStig/issues/419): PowerStig is creating resource xSSLSettings with the wrong value for Name.
-* Updated PowerSTIG to leverage AuditSetting instead of the Script resource. Additionally renamed WmiRule to AuditSettingRule [#431](https://github.com/Microsoft/PowerStig/issues/431)
-
-Added the following STIG
-
-* Added support for Windows 10, Version 1, Release 17 [#442](https://github.com/microsoft/PowerStig/issues/442)
-* Added support for Windows Defender, Version 1, Release 5 [#393](https://github.com/microsoft/PowerStig/issues/393)
-* Added support for Internet Explorer 11 Version 1, Release 17 [#422](https://github.com/Microsoft/PowerStig/issues/422)
-* Added support for Server 2016 STIG, Version 1, Release 8 [#418](https://github.com/Microsoft/PowerStig/issues/418)
-
-## 3.2.0
-
-* Added support for IIS 8.5 Server STIG, Version 1, Release 7 [#399](https://github.com/Microsoft/PowerStig/issues/399)
-* Fixed [#373](https://github.com/Microsoft/PowerStig/issues/373): Registry resource does not handle null values for ValueData contained in Processed STIGs
-* Fixed [#376](https://github.com/Microsoft/PowerStig/issues/376): SQL STIG Rules V-41021 (Instance STIG) and V-41402 (Database STIG) fail to apply when applying to a SQL instance that is NOT name the default (MSSQLSERVER).
-* Fixed [#377](https://github.com/Microsoft/PowerStig/issues/377): SQL Instance Rule V-40936 fails when Set-TargertResource is ran
-* Fixed [#280](https://github.com/Microsoft/PowerStig/issues/280): HKEY_CURRENT_USER is not needed with the cAdministrativeTemplateSetting composite resource. (Regression Issue)
-* Fixed [#385](https://github.com/Microsoft/PowerStig/issues/385): IIS Server STIG V-76681 does not parse correctly
-* Added support for Office 2016 STIGs [#370](https://github.com/Microsoft/PowerStig/issues/370)
-* Added support to Automate Application Pool Recycling for IisSite_8.5 [#378](https://github.com/Microsoft/PowerStig/issues/378)
-* Added support for Windows Server 2012R2 DC V2R16 [#398](https://github.com/Microsoft/PowerStig/issues/398)
-* Added support for update Windows Server 2012 MS STIG v2r15 [#395](https://github.com/Microsoft/PowerStig/issues/395)
-* Added support for Firefox STIG v4r25 [#389](https://github.com/Microsoft/PowerStig/issues/389)
-* Added entry in log file for IISSite 1.7 so rule v-76819 parses as an xWebConfigurationProperty [#407](https://github.com/microsoft/PowerStig/issues/407)
-* Added IISSite v1.7 [#400](https://github.com/microsoft/PowerStig/issues/400)
-* Fixed [#403](https://github.com/microsoft/PowerStig/issues/403): DotNet STIG V1R7 update
-
-## 3.1.0
-
-UPDATES
-
-* Removed duplicate code from rule class constructors
-* Migrated from Get-WmiObject to Get-CimInstance to support PowerShell Core
-* Migrated to PSDscResources [#345](https://github.com/Microsoft/PowerStig/issues/345)
-* Migrated to ComputerManagementDsc [#342](https://github.com/Microsoft/PowerStig/issues/342)
-* Fixed [#358](https://github.com/Microsoft/PowerStig/issues/358): Update PowerSTIG Duplicate Rule handling and capability
-
-Added the following STIG
-
-* Windows Defender V1R4 [#344](https://github.com/Microsoft/PowerStig/issues/344)
-
-## 3.0.1
-
-* Fixed [#350](https://github.com/Microsoft/PowerStig/issues/350): Updates to fix Skip rules not working correctly
-* Fixed [#348](https://github.com/Microsoft/PowerStig/issues/348): Update to DnsServer Schema to correct typo.
-
-## 3.0.0
-
-* Introduces class support for each rule type
-* The STIG class now contains an array of rule objects vs xml elements
-* Orgsettings, Exceptions, and Rule skips are all supported by the Rule base class
-* Rule help is provided for any loaded rule.
-  * See the [wiki](https://github.com/Microsoft/PowerStig/wiki/GettingRuleHelp) for more information.
-* Major code refactor to simplify maintenance and usage
-* [Breaking Change] The STIG class constructor no longer accepts Orgsettings, Exceptions, or Rule skips
-  * That functionality has move to the load rule method
-* DSC composite resource parameter validation for version numbers has been removed
-  * The STIG class validates all input and will throw an error if invalid data is provided.
-* The Get-StigList has be updated and renamed to Get-Stig to return the STIG class
-
-UPDATES
-
-* Fixed [#241](https://github.com/Microsoft/PowerStig/issues/241): [WindowsFeatureRule] PsDesiredStateConfiguration\WindowsOptionalFeature doesn't properly handle features that return $null
-* Fixed [#258](https://github.com/Microsoft/PowerStig/issues/258): New-StigChecklist will not accept a path without an explicit filename
-* Fixed [#243](https://github.com/Microsoft/PowerStig/issues/243): [V-46515] Windows-All-IE11-1.15 Rawstring typo
-* Fixed [#289](https://github.com/Microsoft/PowerStig/issues/289): Updated DocumentRule and DocumentRuleConvert Classes to parse correctly.
-* Fixed [#284](https://github.com/Microsoft/PowerStig/issues/284): [V-74415] [V-74413] Windows 10 STIG rule V-74415 and V-74413 should not contain white space in key
-* Fixed [290](https://github.com/Microsoft/PowerStig/issues/290): [V-76731] IIS Server STIG V-76731 fails to properly set STIG guidance because rule is not split.
-* Fixed [314](https://github.com/Microsoft/PowerStig/issues/314): Update PowerSTIG to Utilize LogTargetW3C parameter in xWebAdministration 2.5.0.0.
-* Fixed [334](https://github.com/Microsoft/PowerStig/issues/334): Update PowerStig to utilize AccessControlDsc 1.3.0.0
-* Fixed [331](https://github.com/Microsoft/PowerStig/issues/331): 2012/R2 [V-39325] 2016 [V-73373], [V-73389] PermissionRule.Convert CheckContent Match Parser Update
-* Fixed [320](https://github.com/Microsoft/PowerStig/issues/320): IIS Site STIG doesn't correctly convert STIGS that contain "SSL Settings" in raw string
-
-* Added the following STIGs
-  * IIS Site 8.5 V1R6 [#276](https://github.com/Microsoft/PowerStig/issues/276)
-  * Windows Firewall STIG V1R7 [#319](https://github.com/Microsoft/PowerStig/issues/319)
-
-* Removed the following STIGs
-  * Windows Server 2012 R2 DC 2.12
-  * Windows Server 2012 R2 DSN 1.7
-  * Active Directory Domain 2.9
-  * IIS Server 8.5 1.3
-  * IIS Site 8.5 1.2
-  * Removed: Internet Explorer 1.13
-
-## 2.4.0.0
-
-* Fixed [#244](https://github.com/Microsoft/PowerStig/issues/244): IIS Server rule V-76727.b org setting test fails
-* Fixed [#246](https://github.com/Microsoft/PowerStig/issues/246): IIS Server rule V-76737 contains an incorrect value
-* Fixed [#225](https://github.com/Microsoft/PowerStig/issues/225): Update PowerStig integration tests to consolidate duplicate code.
-* Fixed [#160](https://github.com/Microsoft/PowerStig/issues/160): PowerStig.Convert needs to handle new registry rules without affecting existing code
-* Fixed [#201](https://github.com/Microsoft/PowerStig/issues/201): Update PowerStig integration tests to account for skips and exceptions.
-* Fixed [#260](https://github.com/Microsoft/PowerStig/issues/260): FireFox Composite Resource configuration applies correctly, but never passes a Test-DscConfiguration.
-* Fixed [#244](https://github.com/Microsoft/PowerStig/issues/244): IIS Server rule V-76727.b org setting test fails
-* Fixed [#265](https://github.com/Microsoft/PowerStig/issues/265): Fixed UserRightsAssignment split rule bug.
-* Fixed [#267](https://github.com/Microsoft/PowerStig/issues/267): Fixed winlogon registry path parser bug.
-* Fixed [#238](https://github.com/Microsoft/PowerStig/issues/238): Adds regex tracker for RegistryRule regex's.
-* Fixed [#274](https://github.com/Microsoft/PowerStig/issues/274): UserRightsAssignment composite resource does not leverage the Force Parameter.
-* Fixed [#280](https://github.com/Microsoft/PowerStig/issues/280): HKEY_CURRENT_USER is not needed with the cAdministrativeTemplateSetting composite resource.
-
-* Windows Server 2012R2 Fixes
-  * V-36707 is now an org setting
-  * (DC only) V-2376 - V-2380 are migrated from manual to account policy rules.
-
-* Added the following STIGs
-  * SQL Server 2016 Instance V1R3 [#186](https://github.com/Microsoft/PowerStig/issues/186)
-  * Windows Defender Antivirus V1R4 [#236](https://github.com/microsoft/PowerStig/issues/236)
-  * Mozilla Firefox V4R24 [#261](https://github.com/Microsoft/PowerStig/issues/261)
-  * Windows Server 2016 V1R6 [#169](https://github.com/Microsoft/PowerStig/issues/169)
-  * Windows Server 2016 V1R7 [#251](https://github.com/Microsoft/PowerStig/issues/251)
-  * SQL Server 2012 Database V1R18 [#263](https://github.com/Microsoft/PowerStig/issues/263)
-  * Windows Server 2012R2 DC V2R15 [#267](https://github.com/Microsoft/PowerStig/issues/267)
-  * Windows 10 V1R16 [#269](https://github.com/Microsoft/PowerStig/issues/269)
-  * IIS Server 8.5 V1R6 [#256](https://github.com/Microsoft/PowerStig/issues/266)
-  * Windows Server 2012R2 DNS V1R11 STIG [#265](https://github.com/Microsoft/PowerStig/issues/265)
-  * AD Domain V2R12 [#270](https://github.com/Microsoft/PowerStig/issues/270)
-
-## 2.3.2.0
-
-* Fixed [#215](https://github.com/Microsoft/PowerStig/issues/215): Org settings wont apply for DotNet STIG
-* Fixed [#216](https://github.com/Microsoft/PowerStig/issues/216): DotNet STIGs are misnamed
-* Fixed [#207](https://github.com/Microsoft/PowerStig/issues/207): SQL Server Database rules fail to apply
-* Fixed [#208](https://github.com/Microsoft/PowerStig/issues/208): Update PowerSTIG to use SQLServerDsc 12.1.0.0
-* Fixed [#220](https://github.com/Microsoft/PowerStig/issues/220): Update PowerSTIG to use xWebAdministration 2.3.0.0
-
-## 2.3.1.0
-
-* Fixed [#212](https://github.com/Microsoft/PowerStig/issues/212): SDDL strings are incorrectly split in the xRegistry resource
-* Fixed [#180](https://github.com/Microsoft/PowerStig/issues/180): IisSite SkipRuleType and SkipRule fail to skip rules
-
-## 2.3.0.0
-
-* Windows 10 Fixes
-  * V-63795 - Changed from manual to registry rule ## HIGH IMPACT CHANGE ##
-
-* Windows Server 2012R2 Fixes
-  * V-1089 - Corrected text
-  * V-21954 - Changed from manual to registry rule ## HIGH IMPACT CHANGE ##
-  * V-26070 - Corrected key path
-  * V-36657 - Corrected key path
-  * V-36681 - Corrected key path
-
-* Added the following STIGs
-  * IIS Server 8.5 STIG V1R5
-  * Microsoft Outlook 2013 STIG V1R13
-  * DotNet Framework 4.0 STIG V1R6
-  * IIS Site 8.5 STIG V1R5
-  * Windows Domain V2R11
-  * FireFox 4.23 STIG
-  * Windows Server 2012R2 DC V2R14
-  * Windows Server 2012R2 MS V2R14
-  * Windows 10 V1R15
-
-## 2.2.0.0
-
-* Added the following STIGs
-  * IIS Site 8.5 STIG V1R2
-  * IIS Site 8.5 STIG V1R3
-  * Oracle JRE 8 STIG V1R5
-  * Microsoft Outlook 2013 STIG V1R12
-  * Microsoft PowerPoint 2013 Stig V1R6
-  * Microsoft Excel 2013 STIG V1R7
-  * Microsoft Word 2013 STIG V1R6
-
-* Added the following DSC Composite Resources
-  * Microsoft Office 2013 STIGs
-  * FireFox STIG
-  * IIS Site STIG
-  * IIS Server STIG
-  * Oracle JRE STIG
-  * Windows10 STIG
-
-* Newly required modules
-  * PolicyFileEditor
-  * FileContentDsc
-  * WindowsDefenderDSC
-  * xWebAdministration
-  * xWinEventLog
-
-* Updated required module versions
-  * xDnsServer from 1.9.0.0 to 1.11.0.0
-  * SecurityPolicyDsc from 2.2.0.0 to 2.4.0.0
-
-## 2.1.0.0
-
-* Migrated Composite resources to the xRegistry resource
-* Fixed 2012R2 V-15713 default org setting value
-* Updated IE STIGs (V-46477) with the decimal value
-* Updated New-StigCheckList to output StigViewer 2.7.1 ckl files
-* Added SkipRule functionality to all composite resources
-* Added StigData for FireFox STIG V4R21
-* Added Sql2012 1.17 to Archive and processed
-* Updated Sql2012 1.16 to fix broken rules
-* Removed Sql2012 1.14 from archives to comply with n-2 version policy
-* Updated data for 2012R2 Stigs to fix broken rules
-
-## 2.0.0.0
-
-* Added a Document module to automatically create a Stig Checklist (EXPERIMENTAL)
-* Merged PowerStigDsc into PowerStig so there is only one module to maintain
-  * Replaced PowerStig Technology Class with Enumeration
-  * Added script module back to manifest
-  * Added DotNetFramework composite resource
-
-* Added the following STIGs
-  * Windows Server 2012R2 MS STIG V2R13
-  * Windows Server 2012R2 DC STIG V2R13
-  * Windows 2012 DNS V1R10
-  * Windows Domain V2R10
-  * Windows Forest V2R8
-  * IE11-V1R16
-
-* Corrected parsing of rule V-46477 in the IE STIGs
-  * Updated StigData
-  * Bug fixes
-  * Removed Windows Server 2012R2 MS and DC StigData v2.9
-
-## 1.1.1.0
-
-Update IIS Server STIG V-76723.a with correct value
-
-## 1.1.0.0
-
-Replaced Technology class with enumeration. This breaks PowerStigDsc < 1.1.0.0
-
-Added the following STIGs:
-
-* IIS 8.5 Server STIG V1R3
-
-Updates
-
-* Updated SQL STIG code to account for SQL STIGS being added in PowerStigDsc
-* Update to PowerStig.psm1 to fix issue were StigData class was not accessible to PowerStigDsc
-
-## 1.0.0.0
-
-Added the following STIGs:
-
-* Windows Server 2012R2 MS STIG V2R12
-* Windows Server 2012R2 DC STIG V2R12
-* Windows Server DNS V1R9
-* Windows AD Domain V2R9
-* IE11 V1R15
diff --git a/DSCResources/Resources/windows.UserRightsAssignment.ps1 b/DSCResources/Resources/windows.UserRightsAssignment.ps1
deleted file mode 100644
index ae714b5b2..000000000
--- a/DSCResources/Resources/windows.UserRightsAssignment.ps1
+++ /dev/null
@@ -1,62 +0,0 @@
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License.
-
-#region Header
-$rules = $stig.RuleList | Select-Rule -Type UserRightRule
-
-$domainGroupTranslation = @{
-    'Administrators'            = 'Builtin\Administrators'
-    'Auditors'                  = '{0}\auditors'
-    'Authenticated Users'       = 'Authenticated Users'
-    'Domain Admins'             = '{0}\Domain Admins'
-    'Guests'                    = 'Guests'
-    'Local Service'             = 'NT Authority\Local Service'
-    'Network Service'           = 'NT Authority\Network Service'
-    'NT Service\WdiServiceHost' = 'NT Service\WdiServiceHost'
-    'NULL'                      = ''
-    'Security'                  = '{0}\security'
-    'Service'                   = 'Service'
-    'Window Manager\Window Manager Group' = 'Window Manager\Window Manager Group'
-}
-
-$forestGroupTranslation = @{
-    'Enterprise Admins'         = '{0}\Enterprise Admins'
-    'Schema Admins'             = '{0}\Schema Admins'
-}
-
-# This requires a local forest and/or domain name to be injected to ensure a valid account name.
-$DomainName = PowerStig\Get-DomainName -DomainName $DomainName -Format NetbiosName
-$ForestName = PowerStig\Get-DomainName -ForestName $ForestName -Format NetbiosName
-
-#endregion Header
-
-foreach ($rule in $rules)
-{
-    Write-Verbose $rule
-    $identitySplit = $rule.Identity -split ","
-    [System.Collections.ArrayList]  $identityList = @()
-
-    foreach ($identity in $identitySplit)
-    {
-        if ($domainGroupTranslation.Contains($identity))
-        {
-            [void] $identityList.Add($domainGroupTranslation.$identity -f $DomainName )
-        }
-        elseif ($forestGroupTranslation.Contains($identity))
-        {
-            [void] $identityList.Add($forestGroupTranslation.$identity -f $ForestName )
-        }
-        # Default to adding the identify as provided for any non-default identities.
-        else
-        {
-            [void] $identityList.Add($identity)
-        }
-    }
-
-    UserRightsAssignment (Get-ResourceTitle -Rule $rule)
-    {
-        Policy   = ($rule.DisplayName -replace " ", "_")
-        Identity = $identityList
-        Force    = [bool]$rule.Force
-    }
-}
diff --git a/FILEHASH.md b/FILEHASH.md
index d8677d568..c6d50a03d 100644
--- a/FILEHASH.md
+++ b/FILEHASH.md
@@ -1,4 +1,4 @@
-# PowerSTIG File Hashes : Module Version 4.3.0
+# PowerSTIG File Hashes : Module Version 4.4.0
 
 Hashes for **PowerSTIG** files are listed in the following table:
 
@@ -14,18 +14,22 @@ Hashes for **PowerSTIG** files are listed in the following table:
 | FireFox-All-4.27.xml | 8F405BAA320B88226F9C38D87E8FD948324EC2D3E07982C31F2276773BF614C2 | 40846 |
 | FireFox-All-4.28.org.default.xml | 5FA83AAFCB1F569D382FC7F66F1BB5D4F245E3B2B5A336D8BA431C16AFC71A27 | 306 |
 | FireFox-All-4.28.xml | E84C9DB143EDA81131510607F0F667200BEF0950FF8E1FC4683C121489A8FCF5 | 38487 |
-| IISServer-8.5-1.7.org.default.xml | ACF3A2FBF19D31CDE937C3680603C6CDE4A8BBC0AC579B363CC6D9E588C3E0ED | 438 |
-| IISServer-8.5-1.7.xml | A47B96A37505F57592A33EC3F3DE0F2AED5FB173814A9C555E2A428355748418 | 126440 |
+| IISServer-10.0-1.1.org.default.xml | 24A3BED5E504DAD377595158256A6A32871C72496118F5B396C3D696ADC99966 | 440 |
+| IISServer-10.0-1.1.xml | 169A78FB169F315217E3B8EB8E28CA89439852F3ADF342A7F3DF544E0D8B5AF8 | 127945 |
+| IISServer-8.5-1.10.org.default.xml | 074E6849FF56C54CD238DF75BEBCD9947D242E5EF716DD47EE15D8B2C710ACEC | 439 |
+| IISServer-8.5-1.10.xml | D8B88D194BF358DAAEC09F658844F5DBAF6CCF1A7DAC6DD34A3C49F413BA93DA | 127204 |
 | IISServer-8.5-1.9.org.default.xml | 891D2D3DA53E8A1241DCE73BF5F02A23FB62F29FBCDC6BE27588C13FBB63E2C7 | 438 |
 | IISServer-8.5-1.9.xml | 954E722BAF59B51A1ED2DF701634A804810195F1FC62FFB377B94B29ABA85F0E | 126777 |
-| IISSite-8.5-1.8.org.default.xml | 35CC6C2284E002B363F9D888AE20B2A66BD46DD9A80448BA0EAEF4D3B2B65CCE | 1491 |
-| IISSite-8.5-1.8.xml | 4BD053CC13A64BB6751225D72F8F3B81B0AB7307F5AAAACE7D24FDDD32FE01DE | 130400 |
+| IISSite-10.0-1.1.org.default.xml | 97A8C5398A15F92BD4EE7413A7B94D58DFD612D711C0313508F64A0F366AE4DB | 1420 |
+| IISSite-10.0-1.1.xml | 521F35F019DCD068E7D431BE2358079948F2C43BBF2AEAEB3D52C208B4F138A7 | 118353 |
+| IISSite-8.5-1.10.org.default.xml | 282999F209A372BDA77EFD1F8D5AC95AEA94801F64631D856197B6BD3DACED92 | 1492 |
+| IISSite-8.5-1.10.xml | 74ABD5BAF3822C3C5BA95E438DA955C3D4EBF36B8796DECA65BD0095F759B796 | 127434 |
 | IISSite-8.5-1.9.org.default.xml | BDB889F63903637B7026F231685CC62767DF0B2BD96A6B34D9DCCB52982A4F15 | 1491 |
 | IISSite-8.5-1.9.xml | 308E6886D71CE588ABABD420E9F2A7282505E5FE8B2D162FFBFBE5FB55E06143 | 131381 |
 | InternetExplorer-11-1.17.org.default.xml | 8A5B2D74C0FB37EFBA5C75BADF21955074EA9338062E00BC3C3BF6238BF80F4A | 306 |
-| InternetExplorer-11-1.17.xml | 7BFA9ED087E94EF8314CB6A4B5AE981125483F55CB9583A06D940D4A8D3B2964 | 330080 |
+| InternetExplorer-11-1.17.xml | D033050A8F8037C06A094705CC5F103C94EACBDE93ACD283F5A4C53AE6347A74 | 329836 |
 | InternetExplorer-11-1.18.org.default.xml | 1095CEEAD18CBBAD9068326B97D520F7F76F1F71331618F17B2138DC8FE55ED4 | 306 |
-| InternetExplorer-11-1.18.xml | 68D731BD29502EF9E519B318FFB4C0584AF92C734277F808D50FB80A87460180 | 332302 |
+| InternetExplorer-11-1.18.xml | 7AB1611E525B8D257E722BE7175898F76EAC1C3AFD592C15738AC7EB365139D4 | 332058 |
 | McAfee-8.8-VirusScan-5.16.org.default.xml | 28792D63E69F797CA02CCAE52F537B1001D9069BD7DE4F5A73375424C19FE660 | 777 |
 | McAfee-8.8-VirusScan-5.16.xml | 22CAEE788CA69690819D46548D19E40163FD8EB799F8EC7FAA4E5FB714C4F445 | 244268 |
 | Office-Excel2013-1.7.org.default.xml | 6A8FBC7AD79015A5261C617A2EFC0084E58BCAFAAD3FA2B8E61BC01A860C102C | 429 |
@@ -46,48 +50,54 @@ Hashes for **PowerSTIG** files are listed in the following table:
 | Office-System2013-1.9.xml | 346A48CA6FD98889F0E60928AA0E87E138CF4E8A45E1BDB82BB04005428638C5 | 122545 |
 | Office-System2016-1.1.org.default.xml | 1BC04F0B3B55ED751A1451845E35821A7A8DE2A9592ED63D70AD422E5B3BB1C4 | 305 |
 | Office-System2016-1.1.xml | 6ABE255AD940C70AA20E72B50FCE9E78BA3C3291C085EFF26581059445904229 | 63544 |
+| Office-Visio2013-1.4.org.default.xml | DEB619FD6632472F27796C703DB93523035A5BCD84A2FE878DABBCFC968FFFD9 | 305 |
+| Office-Visio2013-1.4.xml | 4DDEFCDD8E1D316BB2498D95CC033CBABD536A90EF9D6D1278127F4C4FF8DDA8 | 30296 |
 | Office-Word2013-1.6.org.default.xml | 737AEDF59D64684358B3E58ED4D0C42E5FD99AA4495489B8E625B79CE838E663 | 305 |
 | Office-Word2013-1.6.xml | 85E667D9899F3B98270275D1E2F1E5BEAF3AC39C0D8F3143E61F53FBA74263B9 | 81466 |
 | Office-Word2016-1.1.org.default.xml | 7C6CDD5943A445A748835DDAEA1C2AC2615A2BC21B0570751F234E5AB5D7B14B | 431 |
 | Office-Word2016-1.1.xml | 3309F6DCAFFDC4521E2B40CD6D1FC8DBEFB69972B64BBEC5C4C43BAF74542B84 | 88318 |
 | OracleJRE-8-1.5.org.default.xml | 9F29E6AA7A905712FC4BBA768764219CB4CD7F259A0515A486E0E9EE4BE03F66 | 502 |
 | OracleJRE-8-1.5.xml | D8D451B6E2B88C4F7FA14809CA7E6485E19C6295460342C01EF78E6787F073F3 | 45264 |
-| SqlServer-2012-Database-1.18.org.default.xml | 393D9B940BD03BA8F5DB386964D00F1AD9CD195A62D0F654E8235AF8F8754D02 | 409 |
-| SqlServer-2012-Database-1.18.xml | 6F8DFCC425DDDAB1F6712BE0BB7B996D9D4CA53B64129F3E03131A87186B1362 | 85242 |
 | SqlServer-2012-Database-1.19.org.default.xml | 68A05F4480CD66C7CB07BF7554A6FB580AD1D7826D56F3B399A164321A5904C5 | 409 |
 | SqlServer-2012-Database-1.19.xml | 73EBD394A734F4C66077BA9124FD69131986232BB8800EE88509D98CBC471FED | 85752 |
-| SqlServer-2012-Instance-1.17.org.default.xml | 0F9DDEA039A26476C1437F44C9682229DFBAACC8DA9C928A5EA5853539AB7219 | 923 |
-| SqlServer-2012-Instance-1.17.xml | C5B91C73E2119F6B0F82212A789571986D07C9479A234119A8B8424AD6FD964C | 712294 |
+| SqlServer-2012-Database-1.20.org.default.xml | 47313880BA67BB11CB86B59D2C380B429C6CF8E5C59CD888B3334AD6F015E525 | 409 |
+| SqlServer-2012-Database-1.20.xml | EF0C08AAD52F900B5B1BC6BEDB172F0B4BCBF6EC68603543EC865D0436F5DA9A | 85698 |
 | SqlServer-2012-Instance-1.19.org.default.xml | 9B26B9AFBF4300D9B66FE4A70D748E030F1F09B3C51D6D926A17A003A25EFC54 | 923 |
 | SqlServer-2012-Instance-1.19.xml | 490C90ADBB579E83F54F886CCBC9D62976119925E8D426F18FD8AA8F35D5996C | 719134 |
-| SqlServer-2016-Instance-1.7.org.default.xml | 2E20F6E4ACCE26E9D252B8DBDB2DD8936486EA1BA62C2C2743BC16BB269604D1 | 305 |
-| SqlServer-2016-Instance-1.7.xml | BF7EF1CAAF9F21EDE72591DADBFDB91C88CBC7422DA4F1D7AFAFA8F45E12C598 | 453883 |
+| SqlServer-2012-Instance-1.20.org.default.xml | BF4B54ECA57950AB1EB48D43454B7B6F11FBBE9992981031E3DD1AFC0F3B1C49 | 923 |
+| SqlServer-2012-Instance-1.20.xml | 78A5834304516003F2946217A0690EF602784F4A8D8FEAE43433DB762465CCF7 | 711671 |
 | SqlServer-2016-Instance-1.8.org.default.xml | 2AAB6EFB274E49F158E4B11E31F0A09ED905870C1969A0DD6CEFF1DB237F2A1A | 305 |
 | SqlServer-2016-Instance-1.8.xml | 55BD9E59908DBF1DC6F3D3D9B6D83745E8D98047263193362A5FFB6D800735DB | 456953 |
-| WindowsClient-10-1.18.org.default.xml | EB1149A3E885C09AE0431A2C6F39FC7EB57C8F77BC7238AB6F54D30AF137004C | 3370 |
-| WindowsClient-10-1.18.xml | 64A1FCB57220D56718557FEEAFCF2B067F69E556779FFE55AAEB7DBD72E8A5C4 | 581919 |
+| SqlServer-2016-Instance-1.9.org.default.xml | F2F8E5C12242647D644BB273CBD98CA2A150BA4053A1EF4A83237D6C0DF824E9 | 305 |
+| SqlServer-2016-Instance-1.9.xml | AC72FEEE7C5B60714D8B3962600A74E0269A5710DC952765BB05F2AD345485BF | 454928 |
+| vSphere-6.5-1.3.org.default.xml | C990416E2E49502DADF351E07E50F01FDE10BDDADD940316F943BC31CA043BFA | 791 |
+| vSphere-6.5-1.3.xml | 1DE6CB25FD5ACD705F0F7ED1AB8F062F75B00B85FFD6DD5688D81C51858043A2 | 168420 |
+| Vsphere-6.5-1.4.org.default.xml | 0094C819CBDE50985DC324280712622E3ECAA46E45AFFFEAFB6C91A139B72627 | 791 |
+| Vsphere-6.5-1.4.xml | D78A4D1192D4D0836A6A3FC945F06D4DF3F9EB36F35141A4BED8DC401AEB71DE | 143136 |
 | WindowsClient-10-1.19.org.default.xml | 37EFAFAD0D83AD985BA5665CDC056F0EAEB0C0E59A8F901F6A52375D6F12A240 | 3370 |
-| WindowsClient-10-1.19.xml | 29EFB639C16BCACD2C91B2467084A52D223E52610D3DD96777AEB637131E2D51 | 581920 |
-| WindowsDefender-All-1.6.org.default.xml | 99B065FCAFEED8B7B087E4AD34D2553A947E6ACD01C8D84BBD66AD8D67B7333A | 1071 |
-| WindowsDefender-All-1.6.xml | 46AB44C20CAAEF6B5D52FA200564F43FA39D6D29A63AFC533060ED71872B7825 | 95036 |
+| WindowsClient-10-1.19.xml | 311FAF48DFF288B66798CD47E60B96EC8EA68D46B0D5C9CA0ACD2B155845A1DB | 571026 |
+| WindowsClient-10-1.21.org.default.xml | B4210F9E883D13D1878E25ABF7221CF467E9351B8CE38541810D68CC34F38207 | 3355 |
+| WindowsClient-10-1.21.xml | E007E01ADF09F84B84A5A6AF26975BB1C07C378BD236868CC2FB5EA8F203ECFD | 579792 |
 | WindowsDefender-All-1.7.org.default.xml | C6D7C72A7EC7681FADC9F9CEACE9D7A7BF3391E26DE0E0F202C7C53EA2CD1C8C | 1170 |
 | WindowsDefender-All-1.7.xml | 9657199FA1B037CA49D274BE3B0960F6EF1590178991C9A4B346B5BC9E6BB945 | 95148 |
-| WindowsDnsServer-2012R2-1.12.org.default.xml | 23FF97A3D83B61CF158A800002286DE35ABCE1E857557A9DB14234F177FA9B32 | 449 |
-| WindowsDnsServer-2012R2-1.12.xml | 446F82639433F8D50D35642487948B7B4C7B5E61A81400EC36A793948A8AF2BB | 267981 |
+| WindowsDefender-All-1.8.org.default.xml | C9609DE449345A4BE63AACBEF2EE44689852811ED2D4845F426945C5ADE25897 | 1071 |
+| WindowsDefender-All-1.8.xml | F54DDC75434BF5CA58A57F2FC648A04F90FB7C0A6BC4C10B3BC00DFCF6BB71A5 | 94765 |
 | WindowsDnsServer-2012R2-1.13.org.default.xml | A3864DFF5420392168A937D6D6117BA45F6D2A970BC8CD4E4C094671CD8F323F | 449 |
 | WindowsDnsServer-2012R2-1.13.xml | B79AA5E6E222A7C831E91F46B20369D6C908C1331D834B137E2B3188DE60ED62 | 268259 |
+| WindowsDnsServer-2012R2-1.14.org.default.xml | 86C7CD24C6B8436787923055218ADDEE00D4617C4311B644F3FF8DCED21CD172 | 449 |
+| WindowsDnsServer-2012R2-1.14.xml | 19B0338C1F3E3234B6CA7C5AE37888DBF61AE75EAA35B398E1AA218FC0B85C0D | 268509 |
 | WindowsFirewall-All-1.6.org.default.xml | 129A5B9F20B27E36FED4C1AC470B7B7419B563A6B2733B7FC3112CAF682ABB77 | 966 |
 | WindowsFirewall-All-1.6.xml | 42FA28D3C4BA6387D3EA4F5DCB72F133F814D3A9854555498E22DDFD188194B7 | 65518 |
 | WindowsFirewall-All-1.7.org.default.xml | 64E9FFA9B456C36DD36B5824BF641E473931B5C350F473DDFFDF31B1B64DD016 | 966 |
 | WindowsFirewall-All-1.7.xml | BBB13C6D675EB591D972EF8AD9B46472CFE80FCAD76E9D453586E6BE430F01B6 | 65518 |
 | WindowsServer-2012R2-DC-2.18.org.default.xml | AB84D6DBD15D709B1710851F7D758120132ED1177AA5B52A118DE85B6971563A | 4532 |
-| WindowsServer-2012R2-DC-2.18.xml | 02F450A63656DBD538F9381CD5E6C08F71EDFCBBAAC094DC8B79D81B1A10AE19 | 768234 |
+| WindowsServer-2012R2-DC-2.18.xml | F268E71DD7BEB99615994427B4FC3C782C7F539045A9D9197DA6269942625F99 | 769366 |
 | WindowsServer-2012R2-DC-2.19.org.default.xml | 01BCAB269E9884E0DDD0AD629834E1390820568191FE003B95DF4A2F7C7CA621 | 4532 |
-| WindowsServer-2012R2-DC-2.19.xml | BDBA848C1446D1919CEFB81CCDC9334BBBC1E085AEB9EAD0A275BFFF78844D60 | 768445 |
+| WindowsServer-2012R2-DC-2.19.xml | 2E7E7A4F9709545056277B37C1C38C66F9113DD046F5344F17697826625B0EF1 | 769578 |
 | WindowsServer-2012R2-MS-2.16.org.default.xml | 506B11E8DF549F7303C929BE63FC567C69E31A0F80FA3BC712BDBAE2CF3723EB | 3988 |
-| WindowsServer-2012R2-MS-2.16.xml | 35F9B511C263D257263C9C75E9C18F48B97A5DC3FF94AAD786ACF6FF814F9EA1 | 662064 |
+| WindowsServer-2012R2-MS-2.16.xml | 755BC9A1B5C3699AB343EC667120C07F47ADE0E324A9A3C499F72926BDC7A1AC | 663198 |
 | WindowsServer-2012R2-MS-2.17.org.default.xml | 08D9CB2948D6070F75D95D7AE932E318265ECEFC58ED76C4BE416DDE82BC75A7 | 3988 |
-| WindowsServer-2012R2-MS-2.17.xml | C3EEE623399D2D37379E5159280D77BFEE9A0B16D3D9CFE6D9F11F4818AE6E24 | 662162 |
+| WindowsServer-2012R2-MS-2.17.xml | 7CD06DE12B31384CEE11B8609C71BFA4D988ABA317A8E8B4ED8D26BA7B0AB94B | 663295 |
 | WindowsServer-2016-DC-1.10.org.default.xml | 3FB21C1A859119EFBFD1893BA54EF16F99363397B347A935530EE7EAA57F97CA | 3673 |
 | WindowsServer-2016-DC-1.10.xml | FD96806231106514B2C52EF3498DE9AD05ED3D0D57CCC6C9A12FF01A62609D5A | 545357 |
 | WindowsServer-2016-DC-1.9.org.default.xml | 446EBD5DFB5C597A6095A1A98864DED1E7F2991022FD97B6C454902B10094DDB | 3672 |
diff --git a/GitVersion.yml b/GitVersion.yml
new file mode 100644
index 000000000..86fcd2b2b
--- /dev/null
+++ b/GitVersion.yml
@@ -0,0 +1,38 @@
+mode: ContinuousDelivery
+next-version: 4.3.0
+major-version-bump-message: '\s?(breaking|major|breaking\schange)'
+minor-version-bump-message: '\s?(add|feature|minor)'
+patch-version-bump-message: '\s?(fix|patch)'
+no-bump-message: '\+semver:\s?(none|skip)'
+assembly-informational-format: '{NuGetVersionV2}+Sha.{Sha}.Date.{CommitDate}'
+branches:
+  master:
+    tag: preview
+  pull-request:
+    tag: PR
+  feature:
+    tag: useBranchName
+    increment: Minor
+    regex: f(eature(s)?)?[\/-]
+    source-branches: ['master']
+  hotfix:
+    tag: fix
+    increment: Patch
+    regex: (hot)?fix(es)?[\/-]
+    source-branches: ['master']
+
+ignore:
+  sha: []
+merge-message-formats: {}
+
+
+# feature:
+#   tag: useBranchName
+#   increment: Minor
+#   regex: f(eature(s)?)?[/-]
+#   source-branches: ['master']
+# hotfix:
+#   tag: fix
+#   increment: Patch
+#   regex: (hot)?fix(es)?[/-]
+#   source-branches: ['master']
diff --git a/HISTORIC_CHANGELOG.md b/HISTORIC_CHANGELOG.md
new file mode 100644
index 000000000..9c5f49d78
--- /dev/null
+++ b/HISTORIC_CHANGELOG.md
@@ -0,0 +1,254 @@
+# Historic change log for PowerSTIG
+
+The release notes in the PowerShell Module manifest cannot exceed 10000
+characters. Due to a bug in the CI deploy pipeline this is not handled.
+This file is to temporary move the older change log history to keep the
+change log short.
+
+## [3.3.0] - 2019-08-12
+
+UPDATES
+
+* Fixed [#419](https://github.com/Microsoft/PowerStig/issues/419): PowerStig is creating resource xSSLSettings with the wrong value for Name.
+* Updated PowerSTIG to leverage AuditSetting instead of the Script resource. Additionally renamed WmiRule to AuditSettingRule [#431](https://github.com/Microsoft/PowerStig/issues/431)
+
+Added the following STIG
+
+* Added support for Windows 10, Version 1, Release 17 [#442](https://github.com/microsoft/PowerStig/issues/442)
+* Added support for Windows Defender, Version 1, Release 5 [#393](https://github.com/microsoft/PowerStig/issues/393)
+* Added support for Internet Explorer 11 Version 1, Release 17 [#422](https://github.com/Microsoft/PowerStig/issues/422)
+* Added support for Server 2016 STIG, Version 1, Release 8 [#418](https://github.com/Microsoft/PowerStig/issues/418)
+
+## [3.2.0] - 2019-05-24
+
+* Added support for IIS 8.5 Server STIG, Version 1, Release 7 [#399](https://github.com/Microsoft/PowerStig/issues/399)
+* Fixed [#373](https://github.com/Microsoft/PowerStig/issues/373): Registry resource does not handle null values for ValueData contained in Processed STIGs
+* Fixed [#376](https://github.com/Microsoft/PowerStig/issues/376): SQL STIG Rules V-41021 (Instance STIG) and V-41402 (Database STIG) fail to apply when applying to a SQL instance that is NOT name the default (MSSQLSERVER).
+* Fixed [#377](https://github.com/Microsoft/PowerStig/issues/377): SQL Instance Rule V-40936 fails when Set-TargertResource is ran
+* Fixed [#280](https://github.com/Microsoft/PowerStig/issues/280): HKEY_CURRENT_USER is not needed with the cAdministrativeTemplateSetting composite resource. (Regression Issue)
+* Fixed [#385](https://github.com/Microsoft/PowerStig/issues/385): IIS Server STIG V-76681 does not parse correctly
+* Added support for Office 2016 STIGs [#370](https://github.com/Microsoft/PowerStig/issues/370)
+* Added support to Automate Application Pool Recycling for IisSite_8.5 [#378](https://github.com/Microsoft/PowerStig/issues/378)
+* Added support for Windows Server 2012R2 DC V2R16 [#398](https://github.com/Microsoft/PowerStig/issues/398)
+* Added support for update Windows Server 2012 MS STIG v2r15 [#395](https://github.com/Microsoft/PowerStig/issues/395)
+* Added support for Firefox STIG v4r25 [#389](https://github.com/Microsoft/PowerStig/issues/389)
+* Added entry in log file for IISSite 1.7 so rule v-76819 parses as an xWebConfigurationProperty [#407](https://github.com/microsoft/PowerStig/issues/407)
+* Added IISSite v1.7 [#400](https://github.com/microsoft/PowerStig/issues/400)
+* Fixed [#403](https://github.com/microsoft/PowerStig/issues/403): DotNet STIG V1R7 update
+
+## [3.1.0] - 2019-04-01
+
+UPDATES
+
+* Removed duplicate code from rule class constructors
+* Migrated from Get-WmiObject to Get-CimInstance to support PowerShell Core
+* Migrated to PSDscResources [#345](https://github.com/Microsoft/PowerStig/issues/345)
+* Migrated to ComputerManagementDsc [#342](https://github.com/Microsoft/PowerStig/issues/342)
+* Fixed [#358](https://github.com/Microsoft/PowerStig/issues/358): Update PowerSTIG Duplicate Rule handling and capability
+
+Added the following STIG
+
+* Windows Defender V1R4 [#344](https://github.com/Microsoft/PowerStig/issues/344)
+
+## [3.0.1] - 2019-03-11
+
+* Fixed [#350](https://github.com/Microsoft/PowerStig/issues/350): Updates to fix Skip rules not working correctly
+* Fixed [#348](https://github.com/Microsoft/PowerStig/issues/348): Update to DnsServer Schema to correct typo.
+
+## [3.0.0] - 2019-03-01
+
+* Introduces class support for each rule type
+* The STIG class now contains an array of rule objects vs xml elements
+* Orgsettings, Exceptions, and Rule skips are all supported by the Rule base class
+* Rule help is provided for any loaded rule.
+  * See the [wiki](https://github.com/Microsoft/PowerStig/wiki/GettingRuleHelp) for more information.
+* Major code refactor to simplify maintenance and usage
+* [Breaking Change] The STIG class constructor no longer accepts Orgsettings, Exceptions, or Rule skips
+  * That functionality has move to the load rule method
+* DSC composite resource parameter validation for version numbers has been removed
+  * The STIG class validates all input and will throw an error if invalid data is provided.
+* The Get-StigList has be updated and renamed to Get-Stig to return the STIG class
+
+UPDATES
+
+* Fixed [#241](https://github.com/Microsoft/PowerStig/issues/241): [WindowsFeatureRule] PsDesiredStateConfiguration\WindowsOptionalFeature doesn't properly handle features that return $null
+* Fixed [#258](https://github.com/Microsoft/PowerStig/issues/258): New-StigChecklist will not accept a path without an explicit filename
+* Fixed [#243](https://github.com/Microsoft/PowerStig/issues/243): [V-46515] Windows-All-IE11-1.15 Rawstring typo
+* Fixed [#289](https://github.com/Microsoft/PowerStig/issues/289): Updated DocumentRule and DocumentRuleConvert Classes to parse correctly.
+* Fixed [#284](https://github.com/Microsoft/PowerStig/issues/284): [V-74415] [V-74413] Windows 10 STIG rule V-74415 and V-74413 should not contain white space in key
+* Fixed [290](https://github.com/Microsoft/PowerStig/issues/290): [V-76731] IIS Server STIG V-76731 fails to properly set STIG guidance because rule is not split.
+* Fixed [314](https://github.com/Microsoft/PowerStig/issues/314): Update PowerSTIG to Utilize LogTargetW3C parameter in xWebAdministration 2.5.0.0.
+* Fixed [334](https://github.com/Microsoft/PowerStig/issues/334): Update PowerStig to utilize AccessControlDsc 1.3.0.0
+* Fixed [331](https://github.com/Microsoft/PowerStig/issues/331): 2012/R2 [V-39325] 2016 [V-73373], [V-73389] PermissionRule.Convert CheckContent Match Parser Update
+* Fixed [320](https://github.com/Microsoft/PowerStig/issues/320): IIS Site STIG doesn't correctly convert STIGS that contain "SSL Settings" in raw string
+
+* Added the following STIGs
+  * IIS Site 8.5 V1R6 [#276](https://github.com/Microsoft/PowerStig/issues/276)
+  * Windows Firewall STIG V1R7 [#319](https://github.com/Microsoft/PowerStig/issues/319)
+
+* Removed the following STIGs
+  * Windows Server 2012 R2 DC 2.12
+  * Windows Server 2012 R2 DSN 1.7
+  * Active Directory Domain 2.9
+  * IIS Server 8.5 1.3
+  * IIS Site 8.5 1.2
+  * Removed: Internet Explorer 1.13
+
+## [2.4.0.0] - 2019-02-07
+
+* Fixed [#244](https://github.com/Microsoft/PowerStig/issues/244): IIS Server rule V-76727.b org setting test fails
+* Fixed [#246](https://github.com/Microsoft/PowerStig/issues/246): IIS Server rule V-76737 contains an incorrect value
+* Fixed [#225](https://github.com/Microsoft/PowerStig/issues/225): Update PowerStig integration tests to consolidate duplicate code.
+* Fixed [#160](https://github.com/Microsoft/PowerStig/issues/160): PowerStig.Convert needs to handle new registry rules without affecting existing code
+* Fixed [#201](https://github.com/Microsoft/PowerStig/issues/201): Update PowerStig integration tests to account for skips and exceptions.
+* Fixed [#260](https://github.com/Microsoft/PowerStig/issues/260): FireFox Composite Resource configuration applies correctly, but never passes a Test-DscConfiguration.
+* Fixed [#244](https://github.com/Microsoft/PowerStig/issues/244): IIS Server rule V-76727.b org setting test fails
+* Fixed [#265](https://github.com/Microsoft/PowerStig/issues/265): Fixed UserRightsAssignment split rule bug.
+* Fixed [#267](https://github.com/Microsoft/PowerStig/issues/267): Fixed winlogon registry path parser bug.
+* Fixed [#238](https://github.com/Microsoft/PowerStig/issues/238): Adds regex tracker for RegistryRule regex's.
+* Fixed [#274](https://github.com/Microsoft/PowerStig/issues/274): UserRightsAssignment composite resource does not leverage the Force Parameter.
+* Fixed [#280](https://github.com/Microsoft/PowerStig/issues/280): HKEY_CURRENT_USER is not needed with the cAdministrativeTemplateSetting composite resource.
+
+* Windows Server 2012R2 Fixes
+  * V-36707 is now an org setting
+  * (DC only) V-2376 - V-2380 are migrated from manual to account policy rules.
+
+* Added the following STIGs
+  * SQL Server 2016 Instance V1R3 [#186](https://github.com/Microsoft/PowerStig/issues/186)
+  * Windows Defender Antivirus V1R4 [#236](https://github.com/microsoft/PowerStig/issues/236)
+  * Mozilla Firefox V4R24 [#261](https://github.com/Microsoft/PowerStig/issues/261)
+  * Windows Server 2016 V1R6 [#169](https://github.com/Microsoft/PowerStig/issues/169)
+  * Windows Server 2016 V1R7 [#251](https://github.com/Microsoft/PowerStig/issues/251)
+  * SQL Server 2012 Database V1R18 [#263](https://github.com/Microsoft/PowerStig/issues/263)
+  * Windows Server 2012R2 DC V2R15 [#267](https://github.com/Microsoft/PowerStig/issues/267)
+  * Windows 10 V1R16 [#269](https://github.com/Microsoft/PowerStig/issues/269)
+  * IIS Server 8.5 V1R6 [#256](https://github.com/Microsoft/PowerStig/issues/266)
+  * Windows Server 2012R2 DNS V1R11 STIG [#265](https://github.com/Microsoft/PowerStig/issues/265)
+  * AD Domain V2R12 [#270](https://github.com/Microsoft/PowerStig/issues/270)
+
+## [2.3.2.0] - 2018-12-18
+
+* Fixed [#215](https://github.com/Microsoft/PowerStig/issues/215): Org settings wont apply for DotNet STIG
+* Fixed [#216](https://github.com/Microsoft/PowerStig/issues/216): DotNet STIGs are misnamed
+* Fixed [#207](https://github.com/Microsoft/PowerStig/issues/207): SQL Server Database rules fail to apply
+* Fixed [#208](https://github.com/Microsoft/PowerStig/issues/208): Update PowerSTIG to use SQLServerDsc 12.1.0.0
+* Fixed [#220](https://github.com/Microsoft/PowerStig/issues/220): Update PowerSTIG to use xWebAdministration 2.3.0.0
+
+## [2.3.1.0] - 2018-12-07
+
+* Fixed [#212](https://github.com/Microsoft/PowerStig/issues/212): SDDL strings are incorrectly split in the xRegistry resource
+* Fixed [#180](https://github.com/Microsoft/PowerStig/issues/180): IisSite SkipRuleType and SkipRule fail to skip rules
+
+## [2.3.0.0] - 2018-11-30
+
+* Windows 10 Fixes
+  * V-63795 - Changed from manual to registry rule ## HIGH IMPACT CHANGE ##
+
+* Windows Server 2012R2 Fixes
+  * V-1089 - Corrected text
+  * V-21954 - Changed from manual to registry rule ## HIGH IMPACT CHANGE ##
+  * V-26070 - Corrected key path
+  * V-36657 - Corrected key path
+  * V-36681 - Corrected key path
+
+* Added the following STIGs
+  * IIS Server 8.5 STIG V1R5
+  * Microsoft Outlook 2013 STIG V1R13
+  * DotNet Framework 4.0 STIG V1R6
+  * IIS Site 8.5 STIG V1R5
+  * Windows Domain V2R11
+  * FireFox 4.23 STIG
+  * Windows Server 2012R2 DC V2R14
+  * Windows Server 2012R2 MS V2R14
+  * Windows 10 V1R15
+
+## [2.2.0.0] - 2018-10-10
+
+* Added the following STIGs
+  * IIS Site 8.5 STIG V1R2
+  * IIS Site 8.5 STIG V1R3
+  * Oracle JRE 8 STIG V1R5
+  * Microsoft Outlook 2013 STIG V1R12
+  * Microsoft PowerPoint 2013 Stig V1R6
+  * Microsoft Excel 2013 STIG V1R7
+  * Microsoft Word 2013 STIG V1R6
+
+* Added the following DSC Composite Resources
+  * Microsoft Office 2013 STIGs
+  * FireFox STIG
+  * IIS Site STIG
+  * IIS Server STIG
+  * Oracle JRE STIG
+  * Windows10 STIG
+
+* Newly required modules
+  * PolicyFileEditor
+  * FileContentDsc
+  * WindowsDefenderDSC
+  * xWebAdministration
+  * xWinEventLog
+
+* Updated required module versions
+  * xDnsServer from 1.9.0.0 to 1.11.0.0
+  * SecurityPolicyDsc from 2.2.0.0 to 2.4.0.0
+
+## [2.1.0.0] - 2018-09-05
+
+* Migrated Composite resources to the xRegistry resource
+* Fixed 2012R2 V-15713 default org setting value
+* Updated IE STIGs (V-46477) with the decimal value
+* Updated New-StigCheckList to output StigViewer 2.7.1 ckl files
+* Added SkipRule functionality to all composite resources
+* Added StigData for FireFox STIG V4R21
+* Added Sql2012 1.17 to Archive and processed
+* Updated Sql2012 1.16 to fix broken rules
+* Removed Sql2012 1.14 from archives to comply with n-2 version policy
+* Updated data for 2012R2 Stigs to fix broken rules
+
+## [2.0.0.0] - 2018-08-17
+
+* Added a Document module to automatically create a Stig Checklist (EXPERIMENTAL)
+* Merged PowerStigDsc into PowerStig so there is only one module to maintain
+  * Replaced PowerStig Technology Class with Enumeration
+  * Added script module back to manifest
+  * Added DotNetFramework composite resource
+
+* Added the following STIGs
+  * Windows Server 2012R2 MS STIG V2R13
+  * Windows Server 2012R2 DC STIG V2R13
+  * Windows 2012 DNS V1R10
+  * Windows Domain V2R10
+  * Windows Forest V2R8
+  * IE11-V1R16
+
+* Corrected parsing of rule V-46477 in the IE STIGs
+  * Updated StigData
+  * Bug fixes
+  * Removed Windows Server 2012R2 MS and DC StigData v2.9
+
+## [1.1.1.0] - 2018-08-13
+
+Update IIS Server STIG V-76723.a with correct value
+
+## [1.1.0.0] - 2018-07-29
+
+Replaced Technology class with enumeration. This breaks PowerStigDsc < 1.1.0.0
+
+Added the following STIGs:
+
+* IIS 8.5 Server STIG V1R3
+
+Updates
+
+* Updated SQL STIG code to account for SQL STIGS being added in PowerStigDsc
+* Update to PowerStig.psm1 to fix issue were StigData class was not accessible to PowerStigDsc
+
+## [1.0.0.0] - 2018-07-01
+
+Added the following STIGs:
+
+* Windows Server 2012R2 MS STIG V2R12
+* Windows Server 2012R2 DC STIG V2R12
+* Windows Server DNS V1R9
+* Windows AD Domain V2R9
+* IE11 V1R15
diff --git a/Module/Common/Convert/Data.ps1 b/Module/Common/Convert/Data.ps1
deleted file mode 100644
index c87d7fb9c..000000000
--- a/Module/Common/Convert/Data.ps1
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License.
-
-# This is used to exclude rules from the convert
-data exclusionRuleList
-{
-    ConvertFrom-StringData -StringData @'
-        V-73523 = ''
-        V-6599 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6600 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6601 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6602 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6604 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6611 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6612 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6614 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6615 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6616 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6617 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6618 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6620 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6625 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-6627 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-14657 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-        V-14658 = 'McAfee: Not Applicable to 64-bit systems.'
-        V-14659 = 'McAfee: Not Applicable to 64-bit systems.'
-        V-14660 = 'McAfee: Not Applicable to 64-bit systems.'
-        V-14661 = 'McAfee: Not Applicable to 64-bit systems.'
-        V-42563 = 'McAfee:exclusions have been documented with, and approved by, the ISSO/ISSM/DAA'
-        V-42564 = 'McAfee:exclusions have been documented with, and approved by, the ISSO/ISSM/DAA'
-        V-42565 = 'McAfee:with the assistance of the System Administrator, review each GUID key's szTaskName'
-        V-42566 = 'McAfee:with the assistance of the System Administrator, review each GUID key's szTaskName'
-        V-42567 = 'McAfee:with the assistance of the System Administrator, review each GUID key's szTaskName'
-        V-42572 = 'McAfee:If the ExcludedURLs REG_MULTI_SZ has any entries, and the excluded URLs have not been documented with, and approved by, the ISSO/ISSM/DAA'
-        V-14654 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
-'@
-}
diff --git a/Module/Rule/Rule.LoadFactory.psm1 b/Module/Rule/Rule.LoadFactory.psm1
deleted file mode 100644
index 52fdaf9f5..000000000
--- a/Module/Rule/Rule.LoadFactory.psm1
+++ /dev/null
@@ -1,60 +0,0 @@
-using module .\..\Rule.AccountPolicy\AccountPolicyRule.psm1
-using module .\..\Rule.AuditPolicy\AuditPolicyRule.psm1
-using module .\..\Rule.DnsServerRootHint\DnsServerRootHintRule.psm1
-using module .\..\Rule.DnsServerSetting\DnsServerSettingRule.psm1
-using module .\..\Rule.Document\DocumentRule.psm1
-using module .\..\Rule.FileContent\FileContentRule.psm1
-using module .\..\Rule.Group\GroupRule.psm1
-using module .\..\Rule.IISLogging\IISLoggingRule.psm1
-using module .\..\Rule.Manual\ManualRule.psm1
-using module .\..\Rule.MimeType\MimeTypeRule.psm1
-using module .\..\Rule.Permission\PermissionRule.psm1
-using module .\..\Rule.ProcessMitigation\ProcessMitigationRule.psm1
-using module .\..\Rule.Registry\RegistryRule.psm1
-using module .\..\Rule.SecurityOption\SecurityOptionRule.psm1
-using module .\..\Rule.Service\ServiceRule.psm1
-using module .\..\Rule.SqlScriptQuery\SqlScriptQueryRule.psm1
-using module .\..\Rule.UserRight\UserRightRule.psm1
-using module .\..\Rule.WebAppPool\WebAppPoolRule.psm1
-using module .\..\Rule.WebConfigurationProperty\WebConfigurationPropertyRule.psm1
-using module .\..\Rule.WindowsFeature\WindowsFeatureRule.psm1
-using module .\..\Rule.WinEventLog\WinEventLogRule.psm1
-using module .\..\Rule.AuditSetting\AuditSettingRule.psm1
-using module .\..\Rule.SslSettings\SslSettingsRule.psm1
-#header
-
-class LoadFactory
-{
-    static [psobject] Rule ([xml.xmlelement] $Rule)
-    {
-        $return = $null
-        switch($Rule.ParentNode.Name)
-        {
-            'AccountPolicyRule'             {$return = [AccountPolicyRule]::new($Rule)}
-            'AuditPolicyRule'               {$return = [AuditPolicyRule]::new($Rule)}
-            'DnsServerSettingRule'          {$return = [DnsServerSettingRule]::new($Rule)}
-            'DnsServerRootHintRule'         {$return = [DnsServerRootHintRule]::new($Rule)}
-            'DocumentRule'                  {$return = [DocumentRule]::new($Rule)}
-            'FileContentRule'               {$return = [FileContentRule]::new($Rule)}
-            'GroupRule'                     {$return = [GroupRule]::new($Rule)}
-            'IisLoggingRule'                {$return = [IisLoggingRule]::new($Rule)}
-            'MimeTypeRule'                  {$return = [MimeTypeRule]::new($Rule)}
-            'ManualRule'                    {$return = [ManualRule]::new($Rule)}
-            'PermissionRule'                {$return = [PermissionRule]::new($Rule)}
-            'ProcessMitigationRule'         {$return = [ProcessMitigationRule]::new($Rule)}
-            'RegistryRule'                  {$return = [RegistryRule]::new($Rule)}
-            'SecurityOptionRule'            {$return = [SecurityOptionRule]::new($Rule)}
-            'ServiceRule'                   {$return = [ServiceRule]::new($Rule)}
-            'SqlScriptQueryRule'            {$return = [SqlScriptQueryRule]::new($Rule)}
-            'UserRightRule'                 {$return = [UserRightRule]::new($Rule)}
-            'WebAppPoolRule'                {$return = [WebAppPoolRule]::new($Rule)}
-            'WebConfigurationPropertyRule'  {$return = [WebConfigurationPropertyRule]::new($Rule)}
-            'WindowsFeatureRule'            {$return = [WindowsFeatureRule]::new($Rule)}
-            'WinEventLogRule'               {$return = [WinEventLogRule]::new($Rule)}
-            'AuditSettingRule'              {$return = [AuditSettingRule]::new($Rule)}
-            'SslSettingsRule'               {$return = [SslSettingsRule]::new($Rule)}
-        }
-
-        return $return
-    }
-}
diff --git a/Module/STIG/Convert/Data.ps1 b/Module/STIG/Convert/Data.ps1
deleted file mode 100644
index 74d34b617..000000000
--- a/Module/STIG/Convert/Data.ps1
+++ /dev/null
@@ -1,45 +0,0 @@
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License.
-
-data xmlAttribute
-{
-    ConvertFrom-StringData -StringData @'
-        ruleId                = id
-        ruleSeverity          = severity
-        ruleConversionStatus  = conversionstatus
-        ruleTitle             = title
-        ruleDscResource       = dscresource
-        ruleDscResourceModule = dscresourcemodule
-
-        organizationalSettingValue = value
-'@
-}
-
-data dscResourceModule
-{
-    ConvertFrom-StringData -StringData @'
-        AccountPolicyRule               = SecurityPolicyDsc
-        AuditPolicyRule                 = AuditPolicyDsc
-        DnsServerSettingRule            = xDnsServer
-        DnsServerRootHintRule           = PSDscResources
-        DocumentRule                    = None
-        GroupRule                       = PSDscResources
-        IisLoggingRule                  = xWebAdministration
-        MimeTypeRule                    = xWebAdministration
-        ManualRule                      = None
-        PermissionRule                  = AccessControlDsc
-        ProcessMitigationRule           = WindowsDefenderDsc
-        RegistryRule                    = PSDscResources
-        SecurityOptionRule              = SecurityPolicyDsc
-        ServiceRule                     = PSDscResources
-        SqlScriptQueryRule              = SqlServerDsc
-        UserRightRule                   = SecurityPolicyDsc
-        WebAppPoolRule                  = xWebAdministration
-        WebConfigurationPropertyRule    = xWebAdministration
-        WindowsFeatureRule              = PSDscResources
-        WinEventLogRule                 = xWinEventLog
-        SslSettingsRule                 = xWebAdministration
-        AuditSettingRule                = AuditSystemDsc
-        FileContentRule                 = FileContentDsc
-'@
-}
diff --git a/Resolve-Dependency.ps1 b/Resolve-Dependency.ps1
new file mode 100644
index 000000000..4928e6242
--- /dev/null
+++ b/Resolve-Dependency.ps1
@@ -0,0 +1,289 @@
+[CmdletBinding()]
+param
+(
+
+    [Parameter()]
+    [String]
+    $DependencyFile = 'RequiredModules.psd1',
+
+    [Parameter()]
+    [String]
+    # Path for PSDepend to be bootstrapped and save other dependencies.
+    # Can also be CurrentUser or AllUsers if you wish to install the modules in such scope
+    # Default to $PWD.Path/output/modules
+    $PSDependTarget = (Join-Path $PSScriptRoot './output/RequiredModules'),
+
+    [Parameter()]
+    [uri]
+    # URI to use for Proxy when attempting to Bootstrap PackageProvider & PowerShellGet
+    $Proxy,
+
+    [Parameter()]
+    # Credential to contact the Proxy when provided
+    [PSCredential]$ProxyCredential,
+
+    [Parameter()]
+    [ValidateSet('CurrentUser', 'AllUsers')]
+    [String]
+    # Scope to bootstrap the PackageProvider and PSGet if not available
+    $Scope = 'CurrentUser',
+
+    [Parameter()]
+    [String]
+    # Gallery to use when bootstrapping PackageProvider, PSGet and when calling PSDepend (can be overridden in Dependency files)
+    $Gallery = 'PSGallery',
+
+    [Parameter()]
+    [PSCredential]
+    # Credentials to use with the Gallery specified above
+    $GalleryCredential,
+
+
+    [Parameter()]
+    [switch]
+    # Allow you to use a locally installed version of PowerShellGet older than 1.6.0 (not recommended, default to $False)
+    $AllowOldPowerShellGetModule,
+
+    [Parameter()]
+    [String]
+    # Allow you to specify a minimum version fo PSDepend, if you're after specific features.
+    $MinimumPSDependVersion,
+
+    [Parameter()]
+    [Switch]
+    $AllowPrerelease,
+
+    [Parameter()]
+    [Switch]
+    $WithYAML
+)
+
+# Load Defaults for parameters values from Resolve-Dependency.psd1 if not provided as parameter
+try
+{
+    Write-Verbose -Message "Importing Bootstrap default parameters from '$PSScriptRoot/Resolve-Dependency.psd1'."
+    $ResolveDependencyDefaults = Import-PowerShellDataFile -Path (Join-Path $PSScriptRoot '.\Resolve-Dependency.psd1' -Resolve -ErrorAction Stop)
+    $ParameterToDefault = $MyInvocation.MyCommand.ParameterSets.Where{ $_.Name -eq $PSCmdlet.ParameterSetName }.Parameters.Keys
+    if ($ParameterToDefault.Count -eq 0)
+    {
+        $ParameterToDefault = $MyInvocation.MyCommand.Parameters.Keys
+    }
+    # Set the parameters available in the Parameter Set, or it's not possible to choose yet, so all parameters are an option
+    foreach ($ParamName in $ParameterToDefault)
+    {
+        if (-Not $PSBoundParameters.Keys.Contains($ParamName) -and $ResolveDependencyDefaults.ContainsKey($ParamName))
+        {
+            Write-Verbose -Message "Setting $ParamName with $($ResolveDependencyDefaults[$ParamName])"
+            try
+            {
+                $variableValue = $ResolveDependencyDefaults[$ParamName]
+                if ($variableValue -is [string])
+                {
+                    $variableValue = $ExecutionContext.InvokeCommand.ExpandString($variableValue)
+                }
+                $PSBoundParameters.Add($ParamName, $variableValue)
+                Set-Variable -Name $ParamName -value $variableValue -Force -ErrorAction SilentlyContinue
+            }
+            catch
+            {
+                Write-Verbose -Message "Error adding default for $ParamName : $($_.Exception.Message)"
+            }
+        }
+    }
+}
+catch
+{
+    Write-Warning -Message "Error attempting to import Bootstrap's default parameters from $(Join-Path $PSScriptRoot '.\Resolve-Dependency.psd1'): $($_.Exception.Message)."
+}
+
+Write-Progress -Activity "Bootstrap:" -PercentComplete 0 -CurrentOperation "NuGet Bootstrap"
+
+if (!(Get-PackageProvider -Name NuGet -ForceBootstrap -ErrorAction SilentlyContinue))
+{
+    $providerBootstrapParams = @{
+        Name           = 'nuget'
+        force          = $true
+        ForceBootstrap = $true
+        ErrorAction    = 'Stop'
+    }
+
+    switch ($PSBoundParameters.Keys)
+    {
+        'Proxy'
+        {
+            $providerBootstrapParams.Add('Proxy', $Proxy)
+        }
+        'ProxyCredential'
+        {
+            $providerBootstrapParams.Add('ProxyCredential', $ProxyCredential)
+        }
+        'Scope'
+        {
+            $providerBootstrapParams.Add('Scope', $Scope)
+        }
+    }
+
+    if ($AllowPrerelease)
+    {
+        $providerBootstrapParams.Add('AllowPrerelease', $true)
+    }
+
+    Write-Information "Bootstrap: Installing NuGet Package Provider from the web (Make sure Microsoft addresses/ranges are allowed)"
+    $null = Install-PackageProvider @providerBootstrapParams
+    $latestNuGetVersion = (Get-PackageProvider -Name NuGet -ListAvailable | Select-Object -First 1).Version.ToString()
+    Write-Information "Bootstrap: Importing NuGet Package Provider version $latestNuGetVersion to current session."
+    $Null = Import-PackageProvider -Name NuGet -RequiredVersion $latestNuGetVersion -Force
+}
+
+Write-Progress -Activity "Bootstrap:" -PercentComplete 10 -CurrentOperation "Ensuring Gallery $Gallery is trusted"
+
+# Fail if the given PSGallery is not Registered
+$Policy = (Get-PSRepository $Gallery -ErrorAction Stop).InstallationPolicy
+Set-PSRepository -Name $Gallery -InstallationPolicy Trusted -ErrorAction Ignore
+try
+{
+    Write-Progress -Activity "Bootstrap:" -PercentComplete 25 -CurrentOperation "Checking PowerShellGet"
+    # Ensure the module is loaded and retrieve the version you have
+    $PowerShellGetVersion = (Import-Module PowerShellGet -PassThru -ErrorAction SilentlyContinue).Version
+
+    Write-Verbose "Bootstrap: The PowerShellGet version is $PowerShellGetVersion"
+    # Versions below 1.6.0 are considered old, unreliable & not recommended
+    if (!$PowerShellGetVersion -or ($PowerShellGetVersion -lt [System.version]'1.6.0' -and !$AllowOldPowerShellGetModule))
+    {
+        Write-Progress -Activity "Bootstrap:" -PercentComplete 40 -CurrentOperation "Installing newer version of PowerShellGet"
+        $InstallPSGetParam = @{
+            Name               = 'PowerShellGet'
+            Force              = $True
+            SkipPublisherCheck = $true
+            AllowClobber       = $true
+            Scope              = $Scope
+            Repository         = $Gallery
+        }
+
+        switch ($PSBoundParameters.Keys)
+        {
+            'Proxy'
+            {
+                $InstallPSGetParam.Add('Proxy', $Proxy)
+            }
+            'ProxyCredential'
+            {
+                $InstallPSGetParam.Add('ProxyCredential', $ProxyCredential)
+            }
+            'GalleryCredential'
+            {
+                $InstallPSGetParam.Add('Credential', $GalleryCredential)
+            }
+        }
+
+        Install-Module @InstallPSGetParam
+        Remove-Module PowerShellGet -force -ErrorAction SilentlyContinue
+        Import-Module PowerShellGet -Force
+        $NewLoadedVersion = (Get-Module PowerShellGet).Version.ToString()
+        Write-Information "Bootstrap: PowerShellGet version loaded is $NewLoadedVersion"
+        Write-Progress -Activity "Bootstrap:" -PercentComplete 60 -CurrentOperation "Installing newer version of PowerShellGet"
+    }
+
+    # Try to import the PSDepend module from the available modules
+    try
+    {
+        $ImportPSDependParam = @{
+            Name        = 'PSDepend'
+            ErrorAction = 'Stop'
+            Force       = $true
+        }
+
+        if ($MinimumPSDependVersion)
+        {
+            $ImportPSDependParam.add('MinimumVersion', $MinimumPSDependVersion)
+        }
+        $null = Import-Module @ImportPSDependParam
+    }
+    catch
+    {
+        # PSDepend module not found, installing or saving it
+        if ($PSDependTarget -in 'CurrentUser', 'AllUsers')
+        {
+            Write-Debug "PSDepend module not found. Attempting to install from Gallery $Gallery"
+            Write-Warning "Installing PSDepend in $PSDependTarget Scope"
+            $InstallPSDependParam = @{
+                Name               = 'PSDepend'
+                Repository         = $Gallery
+                Force              = $true
+                Scope              = $PSDependTarget
+                SkipPublisherCheck = $true
+                AllowClobber       = $true
+            }
+
+            if ($MinimumPSDependVersion)
+            {
+                $InstallPSDependParam.add('MinimumVersion', $MinimumPSDependVersion)
+            }
+
+            Write-Progress -Activity "Bootstrap:" -PercentComplete 75 -CurrentOperation "Installing PSDepend from $Gallery"
+            Install-Module @InstallPSDependParam
+        }
+        else
+        {
+            Write-Debug "PSDepend module not found. Attempting to Save from Gallery $Gallery to $PSDependTarget"
+            $SaveModuleParam = @{
+                Name       = 'PSDepend'
+                Repository = $Gallery
+                Path       = $PSDependTarget
+            }
+
+            if ($MinimumPSDependVersion)
+            {
+                $SaveModuleParam.add('MinimumVersion', $MinimumPSDependVersion)
+            }
+
+            Write-Progress -Activity "Bootstrap:" -PercentComplete 75 -CurrentOperation "Saving & Importing PSDepend from $Gallery to $Scope"
+            Save-Module @SaveModuleParam
+        }
+    }
+    finally
+    {
+        Write-Progress -Activity "Bootstrap:" -PercentComplete 100 -CurrentOperation "Loading PSDepend"
+        # We should have successfully bootstrapped PSDepend. Fail if not available
+        Import-Module PSDepend -ErrorAction Stop
+    }
+
+    if ($WithYAML)
+    {
+        if (-Not (Get-Module -ListAvailable -Name 'PowerShell-Yaml'))
+        {
+            Write-Verbose "PowerShell-Yaml module not found. Attempting to Save from Gallery $Gallery to $PSDependTarget"
+            $SaveModuleParam = @{
+                Name       = 'PowerShell-Yaml'
+                Repository = $Gallery
+                Path       = $PSDependTarget
+            }
+
+            Save-Module @SaveModuleParam
+            Import-Module "PowerShell-Yaml" -ErrorAction Stop
+        }
+        else
+        {
+            Write-Verbose "PowerShell-Yaml is already available"
+        }
+    }
+
+    Write-Progress -Activity "PSDepend:" -PercentComplete 0 -CurrentOperation "Restoring Build Dependencies"
+    if (Test-Path $DependencyFile)
+    {
+        $PSDependParams = @{
+            Force = $true
+            Path  = $DependencyFile
+        }
+
+        # TODO: Handle when the Dependency file is in YAML, and -WithYAML is specified
+        Invoke-PSDepend @PSDependParams
+    }
+    Write-Progress -Activity "PSDepend:" -PercentComplete 100 -CurrentOperation "Dependencies restored" -Completed
+}
+finally
+{
+    # Reverting the Installation Policy for the given gallery
+    Set-PSRepository -Name $Gallery -InstallationPolicy $Policy
+    Write-Verbose "Project Bootstrapped, returning to Invoke-Build"
+}
diff --git a/Resolve-Dependency.psd1 b/Resolve-Dependency.psd1
new file mode 100644
index 000000000..b0615a646
--- /dev/null
+++ b/Resolve-Dependency.psd1
@@ -0,0 +1,6 @@
+@{
+    Gallery         = 'PSGallery'
+    AllowPrerelease = $false
+    WithYAML        = $true # Will also bootstrap PowerShell-Yaml to read other config files
+}
+
diff --git a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R18_Manual-xccdf.log b/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R18_Manual-xccdf.log
deleted file mode 100644
index ff187abb7..000000000
--- a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R18_Manual-xccdf.log
+++ /dev/null
@@ -1,7 +0,0 @@
-V-63423::"Minimum password length,"::"Minimum password length"
-V-63429::"Store password using reversible encryption"::"Store passwords using reversible encryption"
-V-68819::Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\::Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\
-V-74413::Registry Path: \SOFTWARE\Policies\Microsoft\ Cryptography\Configuration\SSL\00010002\::Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002\
-V-74415::Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\ Privacy\::Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Privacy\
-V-63685::Registry Hive: HKEY_LOCAL_MACHINE::''
-V-94861::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\'; ValueData = $null; ValueName = 'MinimumPIN'; ValueType = 'DWord'; OrganizationValueTestString = 'ValueData is set to 0x00000006 (6) or greater '}
diff --git a/Tests/Integration/.tests.header.ps1 b/Tests/Integration/.tests.header.ps1
deleted file mode 100644
index f91e172c9..000000000
--- a/Tests/Integration/.tests.header.ps1
+++ /dev/null
@@ -1,8 +0,0 @@
-# Integration test header
-$script:moduleRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
-$script:moduleName = 'PowerStig.Convert'
-$script:modulePath = "$($script:moduleRoot)\$($script:moduleName).psm1"
-
-$helperModulePath = Join-Path -Path $script:moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1'
-Import-Module $helperModulePath -Force
-Import-Module $script:modulePath -Force
diff --git a/Tests/Integration/DSCResources/.tests.header.ps1 b/Tests/Integration/DSCResources/.tests.header.ps1
index 95c1760fe..9b04c0b0c 100644
--- a/Tests/Integration/DSCResources/.tests.header.ps1
+++ b/Tests/Integration/DSCResources/.tests.header.ps1
@@ -1,18 +1,9 @@
-# Integration Test Template Version: 1.1.1
-
 $script:DSCModuleName = 'PowerStig'
 
-[String] $script:moduleRoot = Split-Path -Parent ( Split-Path -Parent ( Split-Path -Parent $PSScriptRoot ) )
-if ( (-not (Test-Path -Path (Join-Path -Path $script:moduleRoot -ChildPath 'DSCResource.Tests'))) -or `
-     (-not (Test-Path -Path (Join-Path -Path $script:moduleRoot -ChildPath 'DSCResource.Tests\TestHelper.psm1'))) )
-{
-    & git @('clone','https://github.com/PowerShell/DscResource.Tests.git',(Join-Path -Path $script:moduleRoot -ChildPath '\DSCResource.Tests\'))
-}
+$script:projectRoot = Split-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent) -Parent
+$script:buildOutput = Join-Path -Path $projectRoot -ChildPath 'output'
+$script:modulePath = (Get-ChildItem -Path $buildOutput -Filter 'PowerStig.psd1' -Recurse).FullName
+$script:moduleRoot = Split-Path -Path $script:modulePath -Parent
+$helperModulePath = Join-Path -Path $script:projectRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1'
 
-Import-Module (Join-Path -Path $script:moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1' ) -Force
-Import-Module (Join-Path -Path $script:moduleRoot -ChildPath 'DSCResource.Tests\TestHelper.psm1') -Force
-[Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseDeclaredVarsMoreThanAssignments",'')]
-$TestEnvironment = Initialize-TestEnvironment `
-    -DSCModuleName $script:DSCModuleName `
-    -DSCResourceName $script:DSCCompositeResourceName `
-    -TestType Integration
+Import-Module -Name $helperModulePath -Force
diff --git a/Tests/Integration/DSCResources/Adobe.integration.tests.ps1 b/Tests/Integration/DSCResources/Adobe.integration.tests.ps1
index 342275e9a..adfb70633 100644
--- a/Tests/Integration/DSCResources/Adobe.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/Adobe.integration.tests.ps1
@@ -2,45 +2,36 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'RegistryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'RegistryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/DotNetFramework.integration.tests.ps1 b/Tests/Integration/DSCResources/DotNetFramework.integration.tests.ps1
index d361499f5..243e1018c 100644
--- a/Tests/Integration/DSCResources/DotNetFramework.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/DotNetFramework.integration.tests.ps1
@@ -1,61 +1,51 @@
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
-{
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
 
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
 
-    foreach ($stig in $stigList)
-    {
-        Describe "Framework $($stig.TechnologyVersion) $($stig.StigVersion) mof output" {
+foreach ($stig in $stigList)
+{
+    Describe "Framework $($stig.TechnologyVersion) $($stig.StigVersion) mof output" {
 
-            It 'Should compile the MOF without throwing' {
-                {
-                    & "$($script:DSCCompositeResourceName)_config" `
-                    -FrameworkVersion $stig.TechnologyVersion `
-                    -StigVersion $stig.StigVersion `
-                    -OutputPath $TestDrive
-                } | Should -Not -Throw
-            }
+        It 'Should compile the MOF without throwing' {
+            {
+                & "$($script:DSCCompositeResourceName)_config" `
+                -FrameworkVersion $stig.TechnologyVersion `
+                -StigVersion $stig.StigVersion `
+                -OutputPath $TestDrive
+            } | Should -Not -Throw
+        }
 
-            [xml] $dscXml = Get-Content -Path $stig.Path
+        [xml] $dscXml = Get-Content -Path $stig.Path
 
-            if (Test-AutomatableRuleType -StigObject $dscXml)
-            {
-                $configurationDocumentPath = "$TestDrive\localhost.mof"
+        if (Test-AutomatableRuleType -StigObject $dscXml)
+        {
+            $configurationDocumentPath = "$TestDrive\localhost.mof"
 
-                $instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
+            $instances = [Microsoft.PowerShell.DesiredStateConfiguration.Internal.DscClassCache]::ImportInstances($configurationDocumentPath, 4)
 
-                Context 'Registry' {
-                    $hasAllSettings = $true
-                    $dscXml = @($dscXml.DISASTIG.RegistryRule.Rule)
-                    $dscMof = $instances |
-                        Where-Object {$PSItem.ResourceID -match '\[Registry\]|\[RegistryPolicyFile\]'}
+            Context 'Registry' {
+                $hasAllSettings = $true
+                $dscXml = @($dscXml.DISASTIG.RegistryRule.Rule)
+                $dscMof = $instances |
+                    Where-Object {$PSItem.ResourceID -match '\[Registry\]|\[RegistryPolicyFile\]'}
 
-                    foreach ($setting in $dscXml)
+                foreach ($setting in $dscXml)
+                {
+                    If (-not ($dscMof.ResourceID -match $setting.Id) )
                     {
-                        If (-not ($dscMof.ResourceID -match $setting.Id) )
-                        {
-                            Write-Warning -Message "Missing registry Setting $($setting.Id)"
-                            $hasAllSettings = $false
-                        }
+                        Write-Warning -Message "Missing registry Setting $($setting.Id)"
+                        $hasAllSettings = $false
                     }
+                }
 
-                    It "Should have $($dscXml.Count) Registry settings" {
-                        $hasAllSettings | Should Be $true
-                    }
+                It "Should have $($dscXml.Count) Registry settings" {
+                    $hasAllSettings | Should Be $true
                 }
             }
         }
     }
 }
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
-}
-
diff --git a/Tests/Integration/DSCResources/Firefox.integration.tests.ps1 b/Tests/Integration/DSCResources/Firefox.integration.tests.ps1
index 164ba800f..ccc6e5d80 100644
--- a/Tests/Integration/DSCResources/Firefox.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/Firefox.integration.tests.ps1
@@ -2,45 +2,36 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'FileContentRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'FileContentRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/IisServer.integration.tests.ps1 b/Tests/Integration/DSCResources/IisServer.integration.tests.ps1
index 8aca760dc..92b291b70 100644
--- a/Tests/Integration/DSCResources/IisServer.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/IisServer.integration.tests.ps1
@@ -2,51 +2,42 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
-{
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
 
-    $additionalTestParameterList = @{
-        LogPath = $env:temp
-    }
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
 
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.MimeTypeRule.Rule.id
-        $skipRuleType = "IisLoggingRule"
-        $expectedSkipRuleTypeCount = $powerstigXml.IisLoggingRule.Rule.Count + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.WebConfigurationPropertyRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = @('MimeTypeRule','IisLoggingRule')
-        $expectedSkipRuleTypeMultipleCount = $powerstigXml.MimeTypeRule.Rule.Count +
-                                             $powerstigXml.IisLoggingRule.Rule.Count +
-                                             $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'WebConfigurationPropertyRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
-    }
+$additionalTestParameterList = @{
+    LogPath = $env:temp
 }
-finally
+
+foreach ($stig in $stigList)
 {
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.MimeTypeRule.Rule.id
+    $skipRuleType = "IisLoggingRule"
+    $expectedSkipRuleTypeCount = $powerstigXml.IisLoggingRule.Rule.Count + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.WebConfigurationPropertyRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = @('MimeTypeRule','IisLoggingRule')
+    $expectedSkipRuleTypeMultipleCount = $powerstigXml.MimeTypeRule.Rule.Count +
+                                            $powerstigXml.IisLoggingRule.Rule.Count +
+                                            $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'WebConfigurationPropertyRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
+    }
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/IisSite.integration.tests.ps1 b/Tests/Integration/DSCResources/IisSite.integration.tests.ps1
index b0e4d1cb8..8b7dc5427 100644
--- a/Tests/Integration/DSCResources/IisSite.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/IisSite.integration.tests.ps1
@@ -2,53 +2,44 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
-{
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
 
-    $additionalTestParameterList = @{
-        WebsiteName = @('WarioSite', 'DKSite')
-        WebAppPool = @('MushroomBeach', 'ToadHarbor')
-    }
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
 
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.WebConfigurationPropertyRule.Rule.id
-        $skipRuleType = "IisLoggingRule"
-        $expectedSkipRuleTypeCount = $powerstigXml.IisLoggingRule.Rule.Count + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.MimeTypeRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = @('WebAppPoolRule','IisLoggingRule')
-        $expectedSkipRuleTypeMultipleCount = $powerstigXml.WebAppPoolRule.Rule.Count +
-                                             $powerstigXml.IisLoggingRule.Rule.Count +
-                                             $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'WebConfigurationPropertyRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $getRandomExceptionRuleParams.RuleType = 'WebAppPoolRule'
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
-    }
+$additionalTestParameterList = @{
+    WebsiteName = @('WarioSite', 'DKSite')
+    WebAppPool = @('MushroomBeach', 'ToadHarbor')
 }
-finally
+
+foreach ($stig in $stigList)
 {
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.WebConfigurationPropertyRule.Rule.id
+    $skipRuleType = "IisLoggingRule"
+    $expectedSkipRuleTypeCount = $powerstigXml.IisLoggingRule.Rule.Count + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.MimeTypeRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = @('WebAppPoolRule','IisLoggingRule')
+    $expectedSkipRuleTypeMultipleCount = $powerstigXml.WebAppPoolRule.Rule.Count +
+                                            $powerstigXml.IisLoggingRule.Rule.Count +
+                                            $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'WebConfigurationPropertyRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
+    }
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $getRandomExceptionRuleParams.RuleType = 'WebAppPoolRule'
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/InternetExplorer.integration.tests.ps1 b/Tests/Integration/DSCResources/InternetExplorer.integration.tests.ps1
index 5449d269c..adfb70633 100644
--- a/Tests/Integration/DSCResources/InternetExplorer.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/InternetExplorer.integration.tests.ps1
@@ -2,45 +2,36 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'RegistryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'RegistryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/McAfee.integration.tests.ps1 b/Tests/Integration/DSCResources/McAfee.integration.tests.ps1
index 76c8fd1cf..ffc5b1720 100644
--- a/Tests/Integration/DSCResources/McAfee.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/McAfee.integration.tests.ps1
@@ -2,46 +2,37 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'RegistryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'RegistryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/Office.integration.tests.ps1 b/Tests/Integration/DSCResources/Office.integration.tests.ps1
index 5449d269c..adfb70633 100644
--- a/Tests/Integration/DSCResources/Office.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/Office.integration.tests.ps1
@@ -2,45 +2,36 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'RegistryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'RegistryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/OracleJRE.integration.tests.ps1 b/Tests/Integration/DSCResources/OracleJRE.integration.tests.ps1
index 436bf4d2a..8dc14519c 100644
--- a/Tests/Integration/DSCResources/OracleJRE.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/OracleJRE.integration.tests.ps1
@@ -2,50 +2,41 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
-{
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
 
-    $additionalTestParameterList = @{
-        configPath = 'C:\Windows\Sun\Java\Deployment\deployment.config'
-        propertiesPath = 'C:\Windows\Java\Deployment\deployment.properties'
-    }
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
 
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'FileContentRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
-    }
+$additionalTestParameterList = @{
+    configPath = 'C:\Windows\Sun\Java\Deployment\deployment.config'
+    propertiesPath = 'C:\Windows\Java\Deployment\deployment.properties'
 }
-finally
+
+foreach ($stig in $stigList)
 {
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.FileContentRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'FileContentRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
+    }
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/SqlServer.config.ps1 b/Tests/Integration/DSCResources/SqlServer.config.ps1
index 67aaf0d72..b387ffad9 100644
--- a/Tests/Integration/DSCResources/SqlServer.config.ps1
+++ b/Tests/Integration/DSCResources/SqlServer.config.ps1
@@ -47,7 +47,7 @@ configuration SqlServer_config
         {
             SqlVersion = $TechnologyVersion
             SqlRole = '$TechnologyRole'
-            StigVersion = $StigVersion
+            StigVersion = '$StigVersion'
             ServerInstance = 'TestServer'
             $(if ($OrgSettings -is [hashtable])
             {
@@ -129,7 +129,7 @@ configuration SqlServerDatabase_config
             SqlRole        = '$TechnologyRole'
             StigVersion    = '$StigVersion'
             ServerInstance = 'TestServer'
-            Database       = 'TestDataBase'
+            Database       = @('TestDataBase','TestDataBase2')
             $(if ($null -ne $OrgSettings)
             {
                 "Orgsettings = '$OrgSettings'"
diff --git a/Tests/Integration/DSCResources/SqlServer.integration.tests.ps1 b/Tests/Integration/DSCResources/SqlServer.integration.tests.ps1
index 16fddf541..cb656d470 100644
--- a/Tests/Integration/DSCResources/SqlServer.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/SqlServer.integration.tests.ps1
@@ -2,45 +2,36 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.SqlScriptQueryRule.Rule.id
-        $skipRuleType = "DocumentRule"
-        $expectedSkipRuleTypeCount = $powerstigXml.DocumentRule.Rule.Count + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.DocumentRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'SqlScriptQueryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = $true
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = $null
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = $null
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.SqlScriptQueryRule.Rule.id
+    $skipRuleType = "DocumentRule"
+    $expectedSkipRuleTypeCount = $powerstigXml.DocumentRule.Rule.Count + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.DocumentRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'SqlScriptQueryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = $null
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = $null
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/Vsphere.config.ps1 b/Tests/Integration/DSCResources/Vsphere.config.ps1
new file mode 100644
index 000000000..78d714518
--- /dev/null
+++ b/Tests/Integration/DSCResources/Vsphere.config.ps1
@@ -0,0 +1,91 @@
+configuration Vsphere_config
+{
+    [CmdletBinding()]
+    param
+    (
+        [Parameter()]
+        [AllowNull()]
+        [string]
+        $TechnologyVersion,
+
+        [Parameter()]
+        [AllowNull()]
+        [string]
+        $TechnologyRole,
+
+        [Parameter(Mandatory = $true)]
+        [version]
+        $StigVersion,
+
+        [Parameter()]
+        [hashtable]
+        $Exception,
+
+        [Parameter()]
+        [hashtable]
+        $BackwardCompatibilityException,
+
+        [Parameter()]
+        [string[]]
+        $SkipRule,
+
+        [Parameter()]
+        [string[]]
+        $SkipRuleType,
+
+        [Parameter()]
+        [object]
+        $OrgSettings,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]
+        $HostIP,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]
+        $ServerIP,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [System.Management.Automation.PSCredential]
+        $Credential,
+
+        [Parameter()]
+        [string[]]
+        $VirtualStandardSwitchGroup,
+
+        [Parameter()]
+        [string[]]
+        $VmGroup
+    )
+
+    Import-DscResource -ModuleName PowerStig
+
+    Node localhost
+    {
+        $psboundParams = $PSBoundParameters
+        $psboundParams.Remove('TechnologyRole')
+        $psboundParams.Remove('ConfigurationData')
+        $psboundParams.Version = $psboundParams['TechnologyVersion']
+        $psboundParams.Remove('TechnologyVersion')
+        $resourceParameters = @(
+            'Version'
+            'StigVersion'
+            'Exception'
+            'SkipRule'
+            'SkipRuleType'
+            'OrgSettings'
+            'HostIP'
+            'ServerIP'
+            'Credential'
+            'VirtualStandardSwitchGroup'
+            'VmGroup'
+        )
+
+        $resourceParamString = New-ResourceParameterString -ResourceParameters $resourceParameters -PSBoundParams $psboundParams
+        $resourceScriptBlockString = New-ResourceString -ResourceParameterString $resourceParamString -ResourceName Vsphere
+        & ([scriptblock]::Create($resourceScriptBlockString))
+    }
+}
diff --git a/Tests/Integration/DSCResources/Vsphere.integration.tests.ps1 b/Tests/Integration/DSCResources/Vsphere.integration.tests.ps1
new file mode 100644
index 000000000..441ebc529
--- /dev/null
+++ b/Tests/Integration/DSCResources/Vsphere.integration.tests.ps1
@@ -0,0 +1,60 @@
+using module .\helper.psm1
+
+$script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
+. $PSScriptRoot\.tests.header.ps1
+
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+$password = ConvertTo-SecureString -AsPlainText -Force -String 'ThisIsAPlaintextPassword'
+$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList 'Admin', $password
+
+$additionalTestParameterList = @{
+    HostIP                     = '10.10.10.10'
+    ServerIP                   = '10.10.10.12'
+    Credential                 = $credential
+    VmGroup                    = @('Vm1','Vm2')
+    VirtualStandardSwitchGroup = @('Switch1','Switch2')
+    ConfigurationData          = @{
+        AllNodes = @(
+            @{
+                NodeName = 'localhost'
+                PSDscAllowDomainUser = $true
+                PSDscAllowPlainTextPassword = $true
+            }
+        )
+    }
+}
+
+foreach ($stig in $stigList)
+{
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.VsphereAdvancedSettingsRule.Rule.id
+    $skipRuleType = 'VsphereAdvancedSettingsRule'
+    $expectedSkipRuleTypeCount = $powerstigXml.VsphereAdvancedSettingsRule.Rule.Count + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.VsphereAdvancedSettingsRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = @('VsphereAdvancedSettingsRule','VsphereAcceptanceLevelRule')
+    $expectedSkipRuleTypeMultipleCount = ($powerstigXml.VsphereAdvancedSettingsRule.Rule | Measure-Object).Count +
+                                         ($powerstigXml.VsphereAcceptanceLevelRule.Rule | Measure-Object).Count +
+                                         ($blankSkipRuleId | Measure-Object).Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'VsphereAdvancedSettingsRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = "'ExceptionKey' = 'ExceptionValue'"
+    }
+
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
+}
diff --git a/Tests/Integration/DSCResources/WindowsClient.integration.tests.ps1 b/Tests/Integration/DSCResources/WindowsClient.integration.tests.ps1
index 7bcc1867b..90578f61e 100644
--- a/Tests/Integration/DSCResources/WindowsClient.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/WindowsClient.integration.tests.ps1
@@ -2,52 +2,43 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
-{
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
 
-    $additionalTestParameterList = @{
-        ForestName = 'integration.test'
-        DomainName = 'integration.test'
-    }
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
 
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-        $skipRuleType = "AuditPolicyRule"
-        $expectedSkipRuleTypeCount = $powerstigXml.AuditPolicyRule.Rule.Count + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = @('AuditPolicyRule','AccountPolicyRule')
-        $expectedSkipRuleTypeMultipleCount = $powerstigXml.AuditPolicyRule.Rule.Count +
-                                             $powerstigXml.AccountPolicyRule.Rule.Count +
-                                             $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'RegistryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
-    }
+$additionalTestParameterList = @{
+    ForestName = 'integration.test'
+    DomainName = 'integration.test'
 }
-finally
+
+foreach ($stig in $stigList)
 {
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+    $skipRuleType = "AuditPolicyRule"
+    $expectedSkipRuleTypeCount = $powerstigXml.AuditPolicyRule.Rule.Count + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = @('AuditPolicyRule','AccountPolicyRule')
+    $expectedSkipRuleTypeMultipleCount = $powerstigXml.AuditPolicyRule.Rule.Count +
+                                            $powerstigXml.AccountPolicyRule.Rule.Count +
+                                            $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'RegistryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
+    }
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/WindowsDefender.integration.tests.ps1 b/Tests/Integration/DSCResources/WindowsDefender.integration.tests.ps1
index 474ee2e36..adfb70633 100644
--- a/Tests/Integration/DSCResources/WindowsDefender.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/WindowsDefender.integration.tests.ps1
@@ -2,49 +2,36 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    #region Integration Tests
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    #region Integration Tests
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'RegistryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'RegistryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-    #endregion Tests
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/WindowsDnsServer.integration.tests.ps1 b/Tests/Integration/DSCResources/WindowsDnsServer.integration.tests.ps1
index 53032d09c..c2be396ed 100644
--- a/Tests/Integration/DSCResources/WindowsDnsServer.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/WindowsDnsServer.integration.tests.ps1
@@ -2,55 +2,46 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
-{
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
 
-    $additionalTestParameterList = @{
-        ForestName = 'integration.test'
-        DomainName = 'integration.test'
-    }
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
 
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject ($powerstigXml.DnsServerSettingRule.Rule |
-            Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).id
-
-        $skipRuleType = "PermissionRule"
-        $expectedSkipRuleTypeCount = ($powerstigXml.PermissionRule.Rule |
-            Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).Count + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject ($powerstigXml.DnsServerSettingRule.Rule |
-            Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).id -Count 2
-        $skipRuleTypeMultiple = @('PermissionRule','UserRightRule')
-        $expectedSkipRuleTypeMultipleCount = ($powerstigXml.PermissionRule.Rule + $powerstigXml.UserRightRule.Rule |
-            Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).Count + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'UserRightRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
-    }
+$additionalTestParameterList = @{
+    ForestName = 'integration.test'
+    DomainName = 'integration.test'
 }
-finally
+
+foreach ($stig in $stigList)
 {
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject ($powerstigXml.DnsServerSettingRule.Rule |
+        Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).id
+
+    $skipRuleType = "PermissionRule"
+    $expectedSkipRuleTypeCount = ($powerstigXml.PermissionRule.Rule |
+        Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).Count + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject ($powerstigXml.DnsServerSettingRule.Rule |
+        Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).id -Count 2
+    $skipRuleTypeMultiple = @('PermissionRule','UserRightRule')
+    $expectedSkipRuleTypeMultipleCount = ($powerstigXml.PermissionRule.Rule + $powerstigXml.UserRightRule.Rule |
+        Where-Object {[string]::IsNullOrEmpty($PsItem.DuplicateOf)}).Count + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'UserRightRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
+    }
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/WindowsFirewall.integration.tests.ps1 b/Tests/Integration/DSCResources/WindowsFirewall.integration.tests.ps1
index 5449d269c..adfb70633 100644
--- a/Tests/Integration/DSCResources/WindowsFirewall.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/WindowsFirewall.integration.tests.ps1
@@ -2,45 +2,36 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
+
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+
+foreach ($stig in $stigList)
 {
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
-
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
-
-    foreach ($stig in $stigList)
-    {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-        $skipRuleType = $null
-        $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
-
-        $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-        $skipRuleTypeMultiple = $null
-        $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
-
-        $getRandomExceptionRuleParams = @{
-            RuleType       = 'RegistryRule'
-            PowerStigXml   = $powerstigXml
-            ParameterValue = 1234567
-        }
-        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
-
-        . "$PSScriptRoot\Common.integration.ps1"
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    $skipRule = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+    $skipRuleType = $null
+    $expectedSkipRuleTypeCount = 0 + $blankSkipRuleId.Count
+
+    $skipRuleMultiple = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+    $skipRuleTypeMultiple = $null
+    $expectedSkipRuleTypeMultipleCount = 0 + $blankSkipRuleId.Count
+
+    $getRandomExceptionRuleParams = @{
+        RuleType       = 'RegistryRule'
+        PowerStigXml   = $powerstigXml
+        ParameterValue = 1234567
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+    $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+    $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+    $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+    $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/WindowsServer.integration.tests.ps1 b/Tests/Integration/DSCResources/WindowsServer.integration.tests.ps1
index b83590514..100f390d2 100644
--- a/Tests/Integration/DSCResources/WindowsServer.integration.tests.ps1
+++ b/Tests/Integration/DSCResources/WindowsServer.integration.tests.ps1
@@ -2,58 +2,49 @@ using module .\helper.psm1
 
 $script:DSCCompositeResourceName = ($MyInvocation.MyCommand.Name -split '\.')[0]
 . $PSScriptRoot\.tests.header.ps1
-# Header
 
-# Using try/finally to always cleanup even if something awful happens.
-try
-{
-    $configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
-    . $configFile
+$configFile = Join-Path -Path $PSScriptRoot -ChildPath "$($script:DSCCompositeResourceName).config.ps1"
+. $configFile
 
-    $stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
+$stigList = Get-StigVersionTable -CompositeResourceName $script:DSCCompositeResourceName
 
-    $additionalTestParameterList = @{
-        ForestName = 'integration.test'
-        DomainName = 'integration.test'
-    }
+$additionalTestParameterList = @{
+    ForestName = 'integration.test'
+    DomainName = 'integration.test'
+}
 
-    foreach ($stig in $stigList)
+foreach ($stig in $stigList)
+{
+    $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
+    $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
+    $powerstigXml = [xml](Get-Content -Path $stig.Path) |
+        Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
+
+    if ($stig.TechnologyRole -eq 'Domain')
     {
-        $orgSettingsPath = $stig.Path.Replace('.xml', '.org.default.xml')
-        $blankSkipRuleId = Get-BlankOrgSettingRuleId -OrgSettingPath $orgSettingsPath
-        $powerstigXml = [xml](Get-Content -Path $stig.Path) |
-            Remove-DscResourceEqualsNone | Remove-SkipRuleBlankOrgSetting -OrgSettingPath $orgSettingsPath
-
-        if ($stig.TechnologyRole -eq 'Domain')
-        {
-            continue
-        }
-        else
-        {
-            $skipRule           = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
-            $skipRuleMultiple   = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
-            $skipRuleType               = "AuditPolicyRule"
-            $expectedSkipRuleTypeCount  = $powerstigXml.AuditPolicyRule.Rule.Count + $blankSkipRuleId.Count
-            $skipRuleTypeMultiple               = @('AuditPolicyRule', 'AccountPolicyRule')
-            $expectedSkipRuleTypeMultipleCount  = $powerstigXml.AuditPolicyRule.Rule.Count +
-                                                  $powerstigXml.AccountPolicyRule.Rule.Count +
-                                                  $blankSkipRuleId.Count
-
-            $getRandomExceptionRuleParams = @{
-                RuleType       = 'RegistryRule'
-                PowerStigXml   = $powerstigXml
-                ParameterValue = 1234567
-            }
-            $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
-            $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
-            $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
-            $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
+        continue
+    }
+    else
+    {
+        $skipRule           = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id
+        $skipRuleMultiple   = Get-Random -InputObject $powerstigXml.RegistryRule.Rule.id -Count 2
+        $skipRuleType               = "AuditPolicyRule"
+        $expectedSkipRuleTypeCount  = $powerstigXml.AuditPolicyRule.Rule.Count + $blankSkipRuleId.Count
+        $skipRuleTypeMultiple               = @('AuditPolicyRule', 'AccountPolicyRule')
+        $expectedSkipRuleTypeMultipleCount  = $powerstigXml.AuditPolicyRule.Rule.Count +
+                                                $powerstigXml.AccountPolicyRule.Rule.Count +
+                                                $blankSkipRuleId.Count
+
+        $getRandomExceptionRuleParams = @{
+            RuleType       = 'RegistryRule'
+            PowerStigXml   = $powerstigXml
+            ParameterValue = 1234567
         }
-
-        . "$PSScriptRoot\Common.integration.ps1"
+        $exception = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1
+        $exceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2
+        $backCompatException = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 1 -BackwardCompatibility
+        $backCompatExceptionMultiple = Get-RandomExceptionRule @getRandomExceptionRuleParams -Count 2 -BackwardCompatibility
     }
-}
-finally
-{
-    Restore-TestEnvironment -TestEnvironment $TestEnvironment
+
+    . "$PSScriptRoot\Common.integration.ps1"
 }
diff --git a/Tests/Integration/DSCResources/helper.psm1 b/Tests/Integration/DSCResources/helper.psm1
index 8fe6f3c14..77d6f288c 100644
--- a/Tests/Integration/DSCResources/helper.psm1
+++ b/Tests/Integration/DSCResources/helper.psm1
@@ -23,6 +23,7 @@ data exceptionRuleParameterValues
         AuditSettingRule             = 'Operator'
         ServiceRule                  = 'StartupType'
         UserRightRule                = 'Identity'
+        VsphereAdvancedSettingsRule  = 'AdvancedSettings'
     }
 }
 #endregion
@@ -132,6 +133,38 @@ function Get-ResourceMatchStatement
         {
             return '\[xSSLSettings\]'
         }
+        'VsphereAcceptanceLevelRule'
+        {
+            return '\[VMHostAcceptanceLevel\]'
+        }
+        'VsphereAdvancedSettingsRule'
+        {
+            return '\[VMHostAdvancedSettings\]'
+        }
+        'VsphereKernelActiveDumpPartitionRule'
+        {
+            return '\[VMHostVMKernelActiveDumpPartition\]'
+        }
+        'VsphereNtpSettingsRule'
+        {
+            return '\[VMHostNtpSettings\]'
+        }
+        'VspherePortGroupSecurityRule'
+        {
+            return '\[VMHostVssPortGroupSecurity\]'
+        }
+        'VsphereServiceRule'
+        {
+            return '\[VMHostService\]'
+        }
+        'VsphereSnmpAgentRule'
+        {
+            return '\[VMHostSnmpAgent\]'
+        }
+        'VsphereVssSecurityRule'
+        {
+            return '\[VMHostVssSecurity\]'
+        }
     }
 }
 
@@ -279,3 +312,175 @@ function Get-RandomExceptionRule
     }
     return $stigException
 }
+
+<#
+    .SYNOPSIS
+        Creates a string representation of the DSC Configuration parameters
+
+    .DESCRIPTION
+        This function is used to help create parameter strings, specifically when non-string
+        parameter values are passed to a configuation. If a string parameter value is
+        passed to this function, it's contents is expanded as a string, however, if a
+        non-string parameter value is passed, the function will pass the variable name
+        as a string so that when a scriptblock is created, the contents of that variable
+        is then expanded at run time.
+
+    .PARAMETER ResourceParameters
+        An array of Resource Parameters that will be used in the string output
+
+    .PARAMETER PSBoundParams
+        A hashtable representing the PSBoundParameters that is passed to the DSC Configuration
+
+    .EXAMPLE
+        This example is used to create a string representation of the configuration block for the
+        Vsphere PowerSTIG DSC Resource.
+
+        Node localhost
+        {
+            $psboundParams = $PSBoundParameters
+            $psboundParams.Remove('TechnologyRole')
+            $psboundParams.Remove('ConfigurationData')
+            $psboundParams.Version = $psboundParams['TechnologyVersion']
+            $psboundParams.Remove('TechnologyVersion')
+            $resourceParameters = @(
+                'Version'
+                'StigVersion'
+                'Exception'
+                'SkipRule'
+                'SkipRuleType'
+                'OrgSettings'
+                'HostIP'
+                'ServerIP'
+                'Credential'
+                'VirtualStandardSwitchGroup'
+                'VmGroup'
+            )
+
+            $resourceParamString = New-ResourceParameterString -ResourceParameters $resourceParameters -PSBoundParams $psboundParams
+            $resourceScriptBlockString = New-ResourceString -ResourceParameterString $resourceParamString -ResourceName Vsphere
+            & ([scriptblock]::Create($resourceScriptBlockString))
+        }
+
+    .NOTES
+        This function is derived from "PSDesiredStateConfiguration\BuildResourceCommonParameters"
+#>
+function New-ResourceParameterString
+{
+    [CmdletBinding()]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [System.Array]
+        $ResourceParameters,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [System.Collections.Hashtable]
+        $PSBoundParams
+    )
+
+    $resourceParameterString = New-Object -TypeName System.Text.StringBuilder
+
+    foreach ($parameterName in $($PSBoundParams.keys))
+    {
+        if ($parameterName -in $ResourceParameters)
+        {
+            $value = $PSBoundParams[$parameterName]
+            if ($null -eq $value)
+            {
+                continue
+            }
+
+            if ($value -is [System.String])
+            {
+                [void] $resourceParameterString.AppendFormat('{0} = "{1}"', $parameterName, $value)
+                [void] $resourceParameterString.AppendLine()
+            }
+            else
+            {
+                [void] $resourceParameterString.Append($parameterName + ' = $' + $parameterName)
+                [void] $resourceParameterString.AppendLine()
+            }
+        }
+    }
+
+    return $resourceParameterString.ToString()
+}
+
+<#
+    .SYNOPSIS
+        This function creates a string that represents a DSC Resource with the given
+        parameters passed to it.
+
+    .DESCRIPTION
+        This function creates a string that represents a DSC Resource with the given
+        parameters passed to it (from New-ResourceParameterString).
+
+    .PARAMETER ResourceParameterString
+        A string from which is generated via New-ResourceParameterString with the parameters
+        that is passed to it.
+
+    .PARAMETER ResourceName
+        The resource name for the configuration being used.
+
+    .EXAMPLE
+        This example is used to create a string representation of the configuration block for the
+        Vsphere PowerSTIG DSC Resource.
+
+        Node localhost
+        {
+            $psboundParams = $PSBoundParameters
+            $psboundParams.Remove('TechnologyRole')
+            $psboundParams.Remove('ConfigurationData')
+            $psboundParams.Version = $psboundParams['TechnologyVersion']
+            $psboundParams.Remove('TechnologyVersion')
+            $resourceParameters = @(
+                'Version'
+                'StigVersion'
+                'Exception'
+                'SkipRule'
+                'SkipRuleType'
+                'OrgSettings'
+                'HostIP'
+                'ServerIP'
+                'Credential'
+                'VirtualStandardSwitchGroup'
+                'VmGroup'
+            )
+
+            $resourceParamString = New-ResourceParameterString -ResourceParameters $resourceParameters -PSBoundParams $psboundParams
+            $resourceScriptBlockString = New-ResourceString -ResourceParameterString $resourceParamString -ResourceName Vsphere
+            & ([scriptblock]::Create($resourceScriptBlockString))
+        }
+
+    .NOTES
+        This function is derived from "PSDesiredStateConfiguration\BuildResourceString"
+#>
+function New-ResourceString
+{
+    [CmdletBinding()]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]
+        $ResourceParameterString,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]
+        $ResourceName
+    )
+
+    $resourceString = New-Object -TypeName System.Text.StringBuilder
+
+    [void] $resourceString.AppendFormat('{0} Baseline', $ResourceName)
+    [void] $resourceString.AppendLine()
+    [void] $resourceString.AppendLine('{')
+    [void] $resourceString.AppendLine()
+    [void] $resourceString.AppendLine($ResourceParameterString)
+    [void] $resourceString.AppendLine('}')
+
+    return $resourceString.ToString()
+}
diff --git a/Tests/Integration/.tests.footer.ps1 b/Tests/Integration/Module/.tests.footer.ps1
similarity index 100%
rename from Tests/Integration/.tests.footer.ps1
rename to Tests/Integration/Module/.tests.footer.ps1
diff --git a/Tests/Integration/Module/.tests.header.ps1 b/Tests/Integration/Module/.tests.header.ps1
new file mode 100644
index 000000000..2410247ce
--- /dev/null
+++ b/Tests/Integration/Module/.tests.header.ps1
@@ -0,0 +1,21 @@
+# Integration test header
+if ((Get-PSCallStack)[1].Command -eq 'PowerStig.Integration.tests.ps1')
+{
+    $script:moduleName = 'PowerStig'
+    $extension = 'psd1'
+}
+else
+{
+    $script:moduleName = 'PowerStig.Convert'
+    $extension = 'psm1'
+}
+
+$script:projectRoot = Split-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent) -Parent
+$script:buildOutput = Join-Path -Path $projectRoot -ChildPath 'output'
+$script:modulePath = (Get-ChildItem -Path $buildOutput -Filter ('{0}.{1}' -f $script:moduleName, $extension) -Recurse).FullName
+$script:moduleRoot = Split-Path -Path $script:modulePath -Parent
+$script:dscCompositePath = Join-Path -Path $script:moduleRoot -ChildPath 'DSCResources'
+$helperModulePath = Join-Path -Path $script:projectRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1'
+
+Import-Module $helperModulePath -Force
+Import-Module $script:modulePath -Force
diff --git a/Tests/Integration/.tests.template.ps1 b/Tests/Integration/Module/.tests.template.txt
similarity index 62%
rename from Tests/Integration/.tests.template.ps1
rename to Tests/Integration/Module/.tests.template.txt
index fbee5f7a8..b1a1bcaf5 100644
--- a/Tests/Integration/.tests.template.ps1
+++ b/Tests/Integration/Module/.tests.template.txt
@@ -1,6 +1,7 @@
 #region Header
-. $PSScriptRoot\.tests.Header.ps1
+. $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
     #region Test Setup
@@ -12,6 +13,6 @@ try
 }
 finally
 {
-    . $PSScriptRoot\.tests.Footer.ps1
+    . $PSScriptRoot\.tests.footer.ps1
 }
 
diff --git a/Tests/Integration/AccountPolicyRule.Convert.Integration.tests.ps1 b/Tests/Integration/Module/AccountPolicyRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/AccountPolicyRule.Convert.Integration.tests.ps1
rename to Tests/Integration/Module/AccountPolicyRule.Integration.tests.ps1
index 566f668c5..a9cbd3a98 100644
--- a/Tests/Integration/AccountPolicyRule.Convert.Integration.tests.ps1
+++ b/Tests/Integration/Module/AccountPolicyRule.Integration.tests.ps1
@@ -1,11 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
-    #endregion
-    #region Tests
     Describe 'ConvertTo-AccountPolicyRule without range' {
         $checkContent = 'Verify the effective setting in Local Group Policy Editor.
         Run "gpedit.msc".
@@ -66,8 +64,8 @@ try
             $rule.conversionstatus | Should Be 'pass'
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/AuditPolicyRule.Integration.tests.ps1 b/Tests/Integration/Module/AuditPolicyRule.Integration.tests.ps1
similarity index 96%
rename from Tests/Integration/AuditPolicyRule.Integration.tests.ps1
rename to Tests/Integration/Module/AuditPolicyRule.Integration.tests.ps1
index 5fe05afd0..bf596a73c 100644
--- a/Tests/Integration/AuditPolicyRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/AuditPolicyRule.Integration.tests.ps1
@@ -4,7 +4,6 @@
 
 try
 {
-    #region Test Setup
     $checkContent = 'Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective.
 
 Use the AuditPol tool to review the current Audit Policy configuration:
@@ -14,8 +13,7 @@ Use the AuditPol tool to review the current Audit Policy configuration:
 Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding.
 
 Account Management -&gt; Computer Account Management - Success'
-    #endregion
-    #region Tests
+
     Describe 'Audit Policy Conversion' {
         [xml] $stigRule = Get-TestStigRule -CheckContent $checkContent -XccdfTitle Windows
         $TestFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
@@ -41,8 +39,8 @@ Account Management -&gt; Computer Account Management - Success'
             $rule.conversionstatus | Should be 'pass'
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/AuditSettingRule.Integration.tests.ps1 b/Tests/Integration/Module/AuditSettingRule.Integration.tests.ps1
similarity index 98%
rename from Tests/Integration/AuditSettingRule.Integration.tests.ps1
rename to Tests/Integration/Module/AuditSettingRule.Integration.tests.ps1
index 6ec27effd..9e82dfdce 100644
--- a/Tests/Integration/AuditSettingRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/AuditSettingRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $rulesToTest = @(
             @{
                 query        = "SELECT * FROM Win32_LogicalDisk WHERE DriveType = '3'"
@@ -80,8 +80,6 @@ try
             }
     )
 
-    #endregion
-    #region Tests
     Describe 'AuditSetting Rule Conversion' {
 
         foreach ( $testRule in $rulesToTest )
@@ -114,8 +112,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/DnsServerRootHintRule.Integration.tests.ps1 b/Tests/Integration/Module/DnsServerRootHintRule.Integration.tests.ps1
similarity index 96%
rename from Tests/Integration/DnsServerRootHintRule.Integration.tests.ps1
rename to Tests/Integration/Module/DnsServerRootHintRule.Integration.tests.ps1
index 07ed2a112..657a31283 100644
--- a/Tests/Integration/DnsServerRootHintRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/DnsServerRootHintRule.Integration.tests.ps1
@@ -4,7 +4,6 @@
 
 try
 {
-    #region Test Setup
     $rootHintsCheckContent = @'
 Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
 
@@ -20,8 +19,7 @@ Verify the "Root Hints" is either empty or only has entries for internal zones u
 
 If "Root Hints" is not empty and the entries on the "Root Hints" tab under "Name servers:" are external to the local network, this is a finding.
 '@
-    #endregion
-    #region Tests
+
     Describe 'DnsServerRootHintRule conversion' {
 
         Context 'Root hints' {
@@ -47,8 +45,8 @@ If "Root Hints" is not empty and the entries on the "Root Hints" tab under "Name
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/DnsServerSettingRule.Integration.tests.ps1 b/Tests/Integration/Module/DnsServerSettingRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/DnsServerSettingRule.Integration.tests.ps1
rename to Tests/Integration/Module/DnsServerSettingRule.Integration.tests.ps1
index 2807ed784..480133f97 100644
--- a/Tests/Integration/DnsServerSettingRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/DnsServerSettingRule.Integration.tests.ps1
@@ -1,10 +1,11 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
-$forwardersCheckContent = @'
+
+    $forwardersCheckContent = @'
 Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
 
 Note: In Windows 2008 DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable
@@ -30,7 +31,7 @@ If forwarders are not enabled and configured, and the "Disable recursion (also d
 selected, this is a finding.
 '@
 
-$eventLogLevelCheckContent = @'
+    $eventLogLevelCheckContent = @'
 Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Press Windows Key + R, execute dnsmgmt.msc.
@@ -44,7 +45,7 @@ Verify "Errors and warnings" or "All events" is selected.
 If any option other than "Errors and warnings" or "All events" is selected, this is a finding.
 '@
 
-$multiUserRightRule = @'
+        $multiUserRightRule = @'
 Review the DNS server to confirm the server restricts direct and remote console access to users other than Administrators.
 
 Verify the effective setting in Local Group Policy Editor.
@@ -70,7 +71,7 @@ If the following accounts or groups are not defined for the "Deny log on locally
 Guests Group
 '@
 
-$userRightPermissionRuleCombo = @'
+    $userRightPermissionRuleCombo = @'
 Verify the effective setting in Local Group Policy Editor.
 
 Run "gpedit.msc".
@@ -104,8 +105,7 @@ Administrators - Full Control
 If the permissions for these files are not as restrictive as the ACLs listed, this is a
 finding.
 '@
-    #endregion
-    #region Tests
+
     Describe 'DnsServerSettingRule conversion' {
 
         Context 'Forwarders' {
@@ -214,8 +214,8 @@ finding.
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/DocumentRule.Integration.tests.ps1 b/Tests/Integration/Module/DocumentRule.Integration.tests.ps1
similarity index 95%
rename from Tests/Integration/DocumentRule.Integration.tests.ps1
rename to Tests/Integration/Module/DocumentRule.Integration.tests.ps1
index 3eeadfd31..3d5a92304 100644
--- a/Tests/Integration/DocumentRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/DocumentRule.Integration.tests.ps1
@@ -3,14 +3,12 @@
 #endregion
 try
 {
-    #region Test Setup
     $checkContent = 'Determine whether any shared accounts exist. If no shared accounts exist, this is NA.
 
     Shared accounts, such as required by an application, may be approved by the organization.  This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.
-    
+
     If unapproved shared accounts exist, this is a finding.'
-    #endregion
-    #region Tests
+
     Describe 'DocumentRule Conversion' {
         [xml] $stigRule = Get-TestStigRule -CheckContent $checkContent -XccdfTitle 'Windows'
         $TestFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
@@ -33,8 +31,8 @@ try
             $rule.conversionstatus | Should Be 'pass'
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.Footer.ps1
diff --git a/Tests/Integration/FileContentRule.Integration.tests.ps1 b/Tests/Integration/Module/FileContentRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/FileContentRule.Integration.tests.ps1
rename to Tests/Integration/Module/FileContentRule.Integration.tests.ps1
index d10f260ef..26cd9bea4 100644
--- a/Tests/Integration/FileContentRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/FileContentRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $fileContentRulesToTest = @(
         @{
             Key          = 'security.default_personal_cert'
@@ -34,7 +34,7 @@ try
 
             1. The preference name "app.update.enabled" is set to "false" and locked or
 
-            2. If set to "true" then verify that "app.update.url", "app.update.url.details" and "app.update.url.manual" contain url information that point to a trusted server and is not the default setting. (Default would contain mozilla.com or Mozilla.org). 
+            2. If set to "true" then verify that "app.update.url", "app.update.url.details" and "app.update.url.manual" contain url information that point to a trusted server and is not the default setting. (Default would contain mozilla.com or Mozilla.org).
 
 
             Criteria: If the parameter is set incorrectly, then this is a finding. If this setting is not locked, then this is a finding.'
@@ -46,13 +46,12 @@ try
             ArchiveFile  = 'OracleJRE'
             CheckContent = 'If the system is on the SIPRNet, this requirement is NA.
 
-            Navigate to the system-level "deployment.properties" file for JRE. 
+            Navigate to the system-level "deployment.properties" file for JRE.
 
             If the key "deployment.security.revocation.check=ALL_CERTIFICATES" is not present, or is set to "PUBLISHER_ONLY", or "NO_CHECK", this is a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'FileContentRule Integration Tests' {
         foreach ($fileContentRule in $fileContentRulesToTest)
         {
@@ -79,8 +78,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/GroupRule.Integration.tests.ps1 b/Tests/Integration/Module/GroupRule.Integration.tests.ps1
similarity index 100%
rename from Tests/Integration/GroupRule.Integration.tests.ps1
rename to Tests/Integration/Module/GroupRule.Integration.tests.ps1
diff --git a/Tests/Integration/IISLoggingRule.Integration.tests.ps1 b/Tests/Integration/Module/IISLoggingRule.Integration.tests.ps1
similarity index 98%
rename from Tests/Integration/IISLoggingRule.Integration.tests.ps1
rename to Tests/Integration/Module/IISLoggingRule.Integration.tests.ps1
index 18e957805..85bba8283 100644
--- a/Tests/Integration/IISLoggingRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/IISLoggingRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
-#endregion
+#
+
 try
 {
-    #region Test Setup
     $stigRulesToTest = @(
         @{
             LogCustomFieldEntry = @(
@@ -88,8 +88,7 @@ try
                 If any of the above fields are not selected, this is a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'IisLogging Rule Conversion' {
 
         foreach ($stig in $stigRulesToTest)
@@ -133,8 +132,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/ManualRule.Integration.tests.ps1 b/Tests/Integration/Module/ManualRule.Integration.tests.ps1
similarity index 92%
rename from Tests/Integration/ManualRule.Integration.tests.ps1
rename to Tests/Integration/Module/ManualRule.Integration.tests.ps1
index 45b331429..0b98bcf29 100644
--- a/Tests/Integration/ManualRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/ManualRule.Integration.tests.ps1
@@ -1,12 +1,11 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $checkContent = 'Verify servers are located in controlled access areas that are accessible only to authorized personnel.  If systems are not adequately protected, this is a finding.'
-    #endregion
-    #region Tests
+
     Describe 'Manual Check Conversion' {
         [xml] $stigRule = Get-TestStigRule -CheckContent $checkContent -XccdfTitle Windows
         $TestFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
@@ -20,8 +19,8 @@ try
             $rule.DscResource | Should Be 'None'
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.Footer.ps1
diff --git a/Tests/Integration/MimeTypeRule.Integration.tests.ps1 b/Tests/Integration/Module/MimeTypeRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/MimeTypeRule.Integration.tests.ps1
rename to Tests/Integration/Module/MimeTypeRule.Integration.tests.ps1
index 8bf5baf79..91cb8ff52 100644
--- a/Tests/Integration/MimeTypeRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/MimeTypeRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $stigRuleToTest = @{
         Ensure       = 'absent'
         Extension    = @('.exe','.dll','.com','.bat','.csh')
@@ -38,8 +38,7 @@ try
     }
 
     $index = 0
-    #endregion
-    #region Tests
+
     Describe 'MimeType Rule Conversion' {
 
         [xml] $stigRule = Get-TestStigRule -CheckContent $stigRuleToTest.CheckContent -XccdfTitle 'IIS'
@@ -75,8 +74,8 @@ try
             $index++
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/PermissionRule.Integration.tests.ps1 b/Tests/Integration/Module/PermissionRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/PermissionRule.Integration.tests.ps1
rename to Tests/Integration/Module/PermissionRule.Integration.tests.ps1
index f84d4e2f5..ab85dab65 100644
--- a/Tests/Integration/PermissionRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/PermissionRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $checkContent = 'Verify the permissions on Event Viewer only allow TrustedInstaller permissions to change or
     modify.  If any groups or accounts other than TrustedInstaller have Full control or Modify, this
     is a finding.
@@ -25,10 +25,9 @@ try
     $principal2 = 'SystemUsers'
     $permission3 = 'Create Folders'
     $inheritance = 'This folder, subfolders and files'
-    #endregion
-    #region Tests
+
     Describe 'Permission Rule Multiple Principals, same permissions, same line' {
-        
+
         $checkContent = $checkContent -f $targetExe, $principal1, $permission1, $principalList,
         $permission2, $principal2, $permission3, $inheritance
         [xml] $stigRule = Get-TestStigRule -CheckContent $checkContent -XccdfTitle Windows
@@ -63,8 +62,8 @@ try
             $rule.dscresource | Should Be 'NTFSAccessEntry'
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/PowerStig.Integration.tests.ps1 b/Tests/Integration/Module/PowerStig.Integration.tests.ps1
similarity index 79%
rename from Tests/Integration/PowerStig.Integration.tests.ps1
rename to Tests/Integration/Module/PowerStig.Integration.tests.ps1
index cb1bb70f1..8c1ef9a86 100644
--- a/Tests/Integration/PowerStig.Integration.tests.ps1
+++ b/Tests/Integration/Module/PowerStig.Integration.tests.ps1
@@ -1,12 +1,5 @@
 #region Header
-# Convert Class Private functions Header V1
-$script:moduleRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
-$script:moduleName = 'PowerStig'
-$script:modulePath = "$($script:moduleRoot)\$($script:moduleName).psd1"
-$script:dscCompositePath = Join-Path -Path $script:moduleRoot -ChildPath 'DSCResources'
-
-Import-Module -Name (Join-Path -Path $script:moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1') -Force
-Import-Module $modulePath -Force
+. $PSScriptRoot\.tests.header.ps1
 #endregion
 
 Describe "$moduleName module" {
@@ -51,4 +44,11 @@ Describe "$moduleName module" {
             $compare.Count | Should Be 0
         }
     }
+
+    Context 'Import PowerSTIG should not throw' {
+
+        It "Should not throw and error" {
+            {Import-Module PowerSTIG} | Should -Not -Throw
+        }
+    }
 }
diff --git a/Tests/Integration/ProcessMitigationRule.Integration.tests.ps1 b/Tests/Integration/Module/ProcessMitigationRule.Integration.tests.ps1
similarity index 98%
rename from Tests/Integration/ProcessMitigationRule.Integration.tests.ps1
rename to Tests/Integration/Module/ProcessMitigationRule.Integration.tests.ps1
index d44bcc69c..1bb87345d 100644
--- a/Tests/Integration/ProcessMitigationRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/ProcessMitigationRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
-#endregion
+#
+
 try
 {
-    #region Test Setup
     $mitigationsRulesToTest = @(
         @{
             MitigationTarget = 'System'
@@ -76,8 +76,7 @@ try
             The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'ProcessMitigation Integration Tests' {
         foreach ($mitigationsRule in $mitigationsRulesToTest)
         {
@@ -127,8 +126,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/RegistryRule.Integration.tests.ps1 b/Tests/Integration/Module/RegistryRule.Integration.tests.ps1
similarity index 99%
rename from Tests/Integration/RegistryRule.Integration.tests.ps1
rename to Tests/Integration/Module/RegistryRule.Integration.tests.ps1
index f0ad9ecd8..0ee78cc93 100644
--- a/Tests/Integration/RegistryRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/RegistryRule.Integration.tests.ps1
@@ -1,9 +1,10 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
+
     $registriesToTest = @(
         @{
             Id                          = 'Rule1'
@@ -186,8 +187,7 @@ try
             Criteria:  If the uAction does not have a value of 5, this is a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'Registry basic settings conversion' {
 
         foreach ($registry in $registriesToTest)
@@ -231,8 +231,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/SecurityOptionRule.Integration.tests.ps1 b/Tests/Integration/Module/SecurityOptionRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/SecurityOptionRule.Integration.tests.ps1
rename to Tests/Integration/Module/SecurityOptionRule.Integration.tests.ps1
index a5d788f80..60aeaff3c 100644
--- a/Tests/Integration/SecurityOptionRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/SecurityOptionRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $testStrings = @(
         @{
             OptionName = 'Network security: Force logoff when logon hours expire'
@@ -29,8 +29,7 @@ try
             If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'Security Option Conversion' {
 
         foreach ( $testString in $testStrings )
@@ -63,8 +62,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/ServiceRule.Integration.tests.ps1 b/Tests/Integration/Module/ServiceRule.Integration.tests.ps1
similarity index 98%
rename from Tests/Integration/ServiceRule.Integration.tests.ps1
rename to Tests/Integration/Module/ServiceRule.Integration.tests.ps1
index 1e796ae86..f36efcaa2 100644
--- a/Tests/Integration/ServiceRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/ServiceRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $servicesToTest = @(
         @{
             ServiceName  = 'masvc'
@@ -65,8 +65,7 @@ try
             ConversionStatus = 'fail'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'Single Service Rule Conversion' {
 
         foreach ( $service in $servicesToTest)
@@ -172,8 +171,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/SqlScriptQueryRule.Integration.tests.ps1 b/Tests/Integration/Module/SqlScriptQueryRule.Integration.tests.ps1
similarity index 99%
rename from Tests/Integration/SqlScriptQueryRule.Integration.tests.ps1
rename to Tests/Integration/Module/SqlScriptQueryRule.Integration.tests.ps1
index 9c4d91c93..bcaadc41f 100644
--- a/Tests/Integration/SqlScriptQueryRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/SqlScriptQueryRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $stigRulesToTest = @(
         @{
             GetScript    = "SELECT name from sysdatabases where name like 'AdventureWorks%'"
@@ -125,8 +125,7 @@ try
             GO"
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'SqlScriptQuery Rule Conversion' {
         foreach ( $stig in $stigRulesToTest )
         {
@@ -176,8 +175,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/SslSettingsRule.Integration.tests.ps1 b/Tests/Integration/Module/SslSettingsRule.Integration.tests.ps1
similarity index 96%
rename from Tests/Integration/SslSettingsRule.Integration.tests.ps1
rename to Tests/Integration/Module/SslSettingsRule.Integration.tests.ps1
index dd4bdbdd7..f5ff0cf70 100644
--- a/Tests/Integration/SslSettingsRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/SslSettingsRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $stigRulesToTest = @(
         @{
             Value        = 'Ssl'
@@ -24,8 +24,7 @@ try
             If the "Require SSL" check box is not selected, this is a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'SslSettings Rule Conversion' {
 
         foreach ( $stig in $stigRulesToTest )
@@ -49,8 +48,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/UserRightsAssignmentRule.Integration.tests.ps1 b/Tests/Integration/Module/UserRightsAssignmentRule.Integration.tests.ps1
similarity index 98%
rename from Tests/Integration/UserRightsAssignmentRule.Integration.tests.ps1
rename to Tests/Integration/Module/UserRightsAssignmentRule.Integration.tests.ps1
index be853f160..4156b6ede 100644
--- a/Tests/Integration/UserRightsAssignmentRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/UserRightsAssignmentRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $rulesToTest = @(
         @{
             displayName  = 'Act as part of the operating system'
@@ -86,8 +86,7 @@ try
             Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'User Rights Assignment Conversion' {
 
         foreach ( $testRule in $rulesToTest )
@@ -123,8 +122,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/Module/VsphereAcceptanceLevelRule.Integration.tests.ps1 b/Tests/Integration/Module/VsphereAcceptanceLevelRule.Integration.tests.ps1
new file mode 100644
index 000000000..23512349c
--- /dev/null
+++ b/Tests/Integration/Module/VsphereAcceptanceLevelRule.Integration.tests.ps1
@@ -0,0 +1,57 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        Level = 'PartnerSupported'
+        CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under "Host Image Profile Acceptance Level" view the acceptance level.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        $esxcli = Get-EsxCli
+        $esxcli.software.acceptance.get()
+
+        If the acceptance level is CommunitySupported, this is a finding.'
+        FixText  = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under "Host Image Profile Acceptance Level" click Edit… and use the pull-down selection, set the acceptance level to be VMwareCertified, VMwareAccepted, or PartnerSupported.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        $esxcli = Get-EsxCli
+        $esxcli.software.acceptance.Set("PartnerSupported")
+
+        Note: VMwareCertified or VMwareAccepted may be substituted for PartnerSupported, depending upon local requirements.'
+    }
+)
+
+try
+{
+    Describe 'VsphereAcceptanceLevel Rule Conversion' {
+
+        Context "When VsphereAcceptanceLevel is converted" {
+
+            It 'Should return a correctly converted "<Level>" Rule' -TestCases $testCases {
+                param ($Level, $CheckContent, $FixText)
+
+                [xml] $stigRule = Get-TestStigRule -CheckContent $CheckContent -FixText $FixText -XccdfTitle 'Vsphere'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name   | Should -Be 'VsphereAcceptanceLevelRule'
+                $rule.Level            | Should -Be $Level
+                $rule.DscResource      | Should -Be 'VMHostAcceptanceLevel'
+                $rule.ConversionStatus | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/Module/VsphereAdvancedSettingsRule.Integration.tests.ps1 b/Tests/Integration/Module/VsphereAdvancedSettingsRule.Integration.tests.ps1
new file mode 100644
index 000000000..97af7839a
--- /dev/null
+++ b/Tests/Integration/Module/VsphereAdvancedSettingsRule.Integration.tests.ps1
@@ -0,0 +1,76 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        AdvancedSettings = "'DCUI.Access' = 'root'"
+        CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Advanced System Settings. Select the DCUI.Access value and verify only the root user is listed.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+        Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.
+
+        If the DCUI.Access is not restricted to root, this is a finding.
+
+        Note: This list is only for local user accounts and should only contain the root user.
+
+        For environments that do not use vCenter server to manage ESXi, this is not applicable.'
+        FixText = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Advanced System Settings. Click Edit and select the DCUI.Access value and configure it to root.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+        Get-VMHost | Get-AdvancedSetting -Name DCUI.Access | Set-AdvancedSetting -Value "root"'
+    }
+    @{
+        AdvancedSettings = "'UserVars.ESXiShellInteractiveTimeOut' = '600'"
+        CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Advanced System Settings. Select the UserVars.ESXiShellInteractiveTimeOut value and verify it is set to 600 (10 Minutes).
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+        Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut
+
+        If the UserVars.ESXiShellInteractiveTimeOut setting is not set to 600, this is a finding.'
+        FixText = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Advanced System Settings. Click Edit and select the UserVars.ESXiShellInteractiveTimeOut value and configure it to 600.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut | Set-AdvancedSetting -Value 600'
+    }
+)
+
+try
+{
+    Describe 'VsphereAdvancedSettings Rule Conversion' {
+
+        Context 'When VsphereAdvancedSettings is converted' {
+
+            It 'Should return a correctly converted "<AdvancedSettings>" Rule' -TestCases $testCases {
+                param ($AdvancedSettings, $CheckContent, $FixText)
+
+                [xml] $stigRule = Get-TestStigRule -Checkcontent $CheckContent -FixText $FixText -XccdfTitle 'Vsphere'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name   | Should -Be 'VsphereAdvancedSettingsRule'
+                $rule.AdvancedSettings | Should -Be $AdvancedSettings
+                $rule.DscResource      | Should -Be 'VMHostAdvancedSettings'
+                $rule.ConversionStatus | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/Module/VsphereKernelActiveDumpPartitionRule.Integration.tests.ps1 b/Tests/Integration/Module/VsphereKernelActiveDumpPartitionRule.Integration.tests.ps1
new file mode 100644
index 000000000..15572438d
--- /dev/null
+++ b/Tests/Integration/Module/VsphereKernelActiveDumpPartitionRule.Integration.tests.ps1
@@ -0,0 +1,69 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        Enabled = '$true'
+        CheckContent = 'From the vSphere Web Client select the ESXi Host and right click. If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        $esxcli = Get-EsxCli
+        $esxcli.system.coredump.partition.get()
+        $esxcli.system.coredump.network.get()
+
+        The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables.
+
+        If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.'
+        FixText  = 'From the vSphere Web Client select the ESXi Host and right click. Select the "Add Diagnostic Partition" option configure a core dump diagnostic partition.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run at least one of the following sets of commands:
+
+        To configure a core dump partition:
+
+        $esxcli = Get-EsxCli
+        #View available partitions to configure
+        $esxcli.system.coredump.partition.list()
+        $esxcli.system.coredump.partition.set($null,"PartitionName",$null,$null)
+
+        To configure a core dump collector:
+
+        $esxcli = Get-EsxCli
+        $esxcli.system.coredump.network.set($null,"vmkernel port to use",$null,"CollectorIP","CollectorPort")
+        $esxcli.system.coredump.network.set($true)
+        '
+    }
+)
+
+try
+{
+    Describe 'VsphereKernelActiveDumpPartition Rule Conversion' {
+
+        Context 'When VsphereKernelActiveDumpPartition is converted' {
+
+            It 'Should return a correctly converted "<Enabled>" Rule' -TestCases $testCases {
+                param ($Enabled, $CheckContent, $FixText)
+
+                [xml] $stigRule = Get-TestStigRule -Checkcontent $CheckContent -FixText $FixText -XccdfTitle 'Vsphere'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name   | Should -Be 'VsphereKernelActiveDumpPartitionRule'
+                $rule.Enabled          | Should -Be $Enabled
+                $rule.DscResource      | Should -Be 'VMHostKernelActiveDumpPartition'
+                $rule.ConversionStatus | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/Module/VsphereNtpSettingsRule.Integration.tests.ps1 b/Tests/Integration/Module/VsphereNtpSettingsRule.Integration.tests.ps1
new file mode 100644
index 000000000..695103c5f
--- /dev/null
+++ b/Tests/Integration/Module/VsphereNtpSettingsRule.Integration.tests.ps1
@@ -0,0 +1,46 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        OrganizationValueTestString = '{0} is set to a string array of authoritative DoD time sources'
+        CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Time Configuration. Click Edit to verify the configured NTP servers and service startup policy.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+        Get-VMHost | Get-VMHostNTPServer
+
+        If the NTP service is not configured with authoritative DoD time sources and the service is not configured to start and stop with the host and is running, this is a finding.'
+    }
+)
+
+try
+{
+    Describe 'VsphereNtpSettings Rule Conversion' {
+
+        Context 'When VsphereNtpSettings is converted' {
+
+            It 'Should return a correctly converted "<OrganizationValueTestString>" Rule' -TestCases $testCases {
+                param ($OrganizationValueTestString, $CheckContent)
+
+                [xml] $stigRule = Get-TestStigRule -Checkcontent $CheckContent -XccdfTitle 'Vsphere' -GroupId 'V-94039'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name              | Should -Be 'VsphereNtpSettingsRule'
+                $rule.OrganizationValueTestString | Should -Be $OrganizationValueTestString
+                $rule.DscResource                 | Should -Be 'VMHostNtpSettings'
+                $rule.ConversionStatus            | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/Module/VspherePortGroupSecurityRule.Integration.tests.ps1 b/Tests/Integration/Module/VspherePortGroupSecurityRule.Integration.tests.ps1
new file mode 100644
index 000000000..6670e65fc
--- /dev/null
+++ b/Tests/Integration/Module/VspherePortGroupSecurityRule.Integration.tests.ps1
@@ -0,0 +1,55 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        VmGroup = @('VM1','VM2')
+        MacChangesInherited = '$true'
+        CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        Get-VirtualPortGroup | Get-SecurityPolicy
+
+        If the "MAC Address Changes" policy is set to accept, this is a finding.'
+        FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "MAC Address Changes" to reject.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -MacChangesInherited $true'
+
+    }
+)
+
+try
+{
+    Describe 'VspherePortGroupSecurity Rule Conversion' {
+
+        Context 'When VspherePortGroupSecurity is converted' {
+
+            It 'Should return a correctly converted "<MacChangesInherited>" Rule' -TestCases $testCases {
+                param ($VmGroup, $MacChangesInherited, $CheckContent, $FixText)
+
+                [xml] $stigRule = Get-TestStigRule -Checkcontent $CheckContent -FixText $FixText -XccdfTitle 'Vsphere'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name      | Should -Be 'VspherePortGroupSecurityRule'
+                $rule.MacChangesInherited | Should -Be $MacChangesInherited
+                $rule.DscResource         | Should -Be 'VMHostVssPortGroupSecurity'
+                $rule.ConversionStatus    | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/Module/VsphereServiceRule.Integration.tests.ps1 b/Tests/Integration/Module/VsphereServiceRule.Integration.tests.ps1
new file mode 100644
index 000000000..de13cc7fc
--- /dev/null
+++ b/Tests/Integration/Module/VsphereServiceRule.Integration.tests.ps1
@@ -0,0 +1,50 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        Key = 'TSM-SSH'
+        Policy = 'off'
+        Running = 'False'
+        CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under Services select Edit and view the "SSH" service and verify it is stopped.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+        Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"}
+
+        If the ESXi SSH service is running, this is a finding.'
+    }
+)
+
+try
+{
+    Describe 'VsphereService Rule Conversion' {
+
+        Context 'When VsphereService is converted' {
+
+            It 'Should return a correctly converted "<Key>" Rule' -TestCases $testCases {
+                param ($Key, $Policy, $Running, $CheckContent)
+
+                [xml] $stigRule = Get-TestStigRule -Checkcontent $CheckContent -XccdfTitle 'Vsphere'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name   | Should -Be 'VsphereServiceRule'
+                $rule.Key              | Should -Be $Key
+                $rule.Policy           | Should -Be $Policy
+                $rule.Running          | Should -Be $Running
+                $rule.DscResource      | Should -Be 'VMHostService'
+                $rule.ConversionStatus | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/Module/VsphereSnmpAgentRule.Integration.tests.ps1 b/Tests/Integration/Module/VsphereSnmpAgentRule.Integration.tests.ps1
new file mode 100644
index 000000000..759ce4e55
--- /dev/null
+++ b/Tests/Integration/Module/VsphereSnmpAgentRule.Integration.tests.ps1
@@ -0,0 +1,65 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        Enabled = '$false'
+        CheckContent = 'From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+        Get-VMHostSnmp | Select *
+
+        or
+
+        From a console or ssh session run the follow command:
+
+        esxcli system snmp get
+
+        If SNMP is not in use and is enabled, this is a finding.
+
+        If SNMP is enabled and read only communities is set to public, this is a finding.
+
+        If SNMP is enabled and is not using v3 targets, this is a finding.
+
+        Note: SNMP v3 targets can only be viewed and configured from the esxcli command.'
+        FixText = 'To disable SNMP run the following command from a PowerCLI command prompt while connected to the ESXi Host:
+
+        Get-VMHostSnmp | Set-VMHostSnmp -Enabled $false
+
+        or
+
+        From a console or ssh session run the follow command:
+
+        esxcli system snmp set -e no
+
+        To configure SNMP for v3 targets use the "esxcli system snmp set" command set.'
+    }
+)
+
+try
+{
+    Describe 'VsphereSnmpAgent Rule Conversion' {
+
+        Context 'When VsphereSnmpAgent is converted' {
+
+            It 'Should return a correctly converted "<Enabled>" Rule' -TestCases $testCases {
+                param ($Enabled, $CheckContent, $FixText)
+
+                [xml] $stigRule = Get-TestStigRule -Checkcontent $CheckContent -FixText $FixText -XccdfTitle 'Vsphere'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name   | Should -Be 'VsphereSnmpAgentRule'
+                $rule.Enabled          | Should -Be $Enabled
+                $rule.DscResource      | Should -Be 'VMHostSnmpAgent'
+                $rule.ConversionStatus | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/Module/VsphereVssSecurityRule.Integration.tests.ps1 b/Tests/Integration/Module/VsphereVssSecurityRule.Integration.tests.ps1
new file mode 100644
index 000000000..cc069f41e
--- /dev/null
+++ b/Tests/Integration/Module/VsphereVssSecurityRule.Integration.tests.ps1
@@ -0,0 +1,54 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+$testCases = @(
+    @{
+        VirtualStandardSwitchGroup = @('Switch1','Switch2')
+        ForgedTransmits = '$false'
+        CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        Get-VirtualSwitch | Get-SecurityPolicy
+
+        If the "Forged Transmits" policy is set to accept, this is a finding.'
+        FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "Forged Transmits" to reject.
+
+        or
+
+        From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+        Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -ForgedTransmits $false'
+    }
+)
+
+try
+{
+    Describe 'VsphereVssSecurity Rule Conversion' {
+
+        Context 'When VsphereVssSecurity is converted' {
+
+            It 'Should return a correctly converted "<ForgedTransmits>" Rule' -TestCases $testCases {
+                param ($VirtualStandardSwitchGroup, $ForgedTransmits, $CheckContent, $FixText)
+
+                [xml] $stigRule = Get-TestStigRule -Checkcontent $CheckContent -FixText $FixText -XccdfTitle 'Vsphere'
+                $testFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml'
+                $stigRule.Save($testFile)
+                $rule = ConvertFrom-StigXccdf -Path $testFile
+
+                $rule.GetType().Name   | Should -Be 'VsphereVssSecurityRule'
+                $rule.ForgedTransmits  | Should -Be $ForgedTransmits
+                $rule.DscResource      | Should -Be 'VMHostVssSecurity'
+                $rule.ConversionStatus | Should -Be 'pass'
+            }
+        }
+    }
+}
+
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Integration/WebAppPoolRule.Integration.tests.ps1 b/Tests/Integration/Module/WebAppPoolRule.Integration.tests.ps1
similarity index 96%
rename from Tests/Integration/WebAppPoolRule.Integration.tests.ps1
rename to Tests/Integration/Module/WebAppPoolRule.Integration.tests.ps1
index 1845e1886..79c8a99a5 100644
--- a/Tests/Integration/WebAppPoolRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/WebAppPoolRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $stigRulesToTest = @(
         @{
             Key          = 'rapidFailProtection'
@@ -36,8 +36,7 @@ try
             If the value for "Ping Enabled" is not set to "True", this is a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'WebAppPool Rule Conversion' {
 
         foreach ( $stig in $stigRulesToTest )
@@ -64,8 +63,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/WebConfigurationPropertyRule.Integration.tests.ps1 b/Tests/Integration/Module/WebConfigurationPropertyRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/WebConfigurationPropertyRule.Integration.tests.ps1
rename to Tests/Integration/Module/WebConfigurationPropertyRule.Integration.tests.ps1
index facc1fb81..ef8c8561a 100644
--- a/Tests/Integration/WebConfigurationPropertyRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/WebConfigurationPropertyRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $stigRulesToTest = @(
         @{
             ConfigSection = '/system.webServer/security/requestFiltering'
@@ -52,8 +52,7 @@ try
             Verify "HMACSHA256"'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'WebConfigurationProperty Rule Conversion' {
 
         foreach ( $stig in $stigRulesToTest )
@@ -86,8 +85,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/WinEventLogRule.Integration.tests.ps1 b/Tests/Integration/Module/WinEventLogRule.Integration.tests.ps1
similarity index 97%
rename from Tests/Integration/WinEventLogRule.Integration.tests.ps1
rename to Tests/Integration/Module/WinEventLogRule.Integration.tests.ps1
index 8e9b776de..bc56ceba7 100644
--- a/Tests/Integration/WinEventLogRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/WinEventLogRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $EventsToTest = @(
         @{
             LogName      = 'Microsoft-Windows-DnsServer/Analytical'
@@ -44,8 +44,7 @@ try
             If the check box to enable analytic and debug logs is not enabled on a Windows 2012 R2 DNS server, this is a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'DnsWinEventLog Rule Conversion' {
 
         foreach ( $WinEvents in $EventsToTest)
@@ -75,8 +74,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Integration/WindowsFeatureRule.Integration.tests.ps1 b/Tests/Integration/Module/WindowsFeatureRule.Integration.tests.ps1
similarity index 98%
rename from Tests/Integration/WindowsFeatureRule.Integration.tests.ps1
rename to Tests/Integration/Module/WindowsFeatureRule.Integration.tests.ps1
index 5dadb3703..223f442eb 100644
--- a/Tests/Integration/WindowsFeatureRule.Integration.tests.ps1
+++ b/Tests/Integration/Module/WindowsFeatureRule.Integration.tests.ps1
@@ -1,9 +1,9 @@
 #region Header
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Test Setup
     $testStrings = @(
         @{
             Name  = 'SMB1Protocol'
@@ -66,8 +66,7 @@ try
             An Installed State of "Available" or "Removed" is not a finding.'
         }
     )
-    #endregion
-    #region Tests
+
     Describe 'Windows Feature Conversion' {
 
         foreach ($testString in $testStrings)
@@ -108,8 +107,8 @@ try
             }
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Unit/DSCResources/.tests.header.ps1 b/Tests/Unit/DSCResources/.tests.header.ps1
index 13ed16ecb..145ab0615 100644
--- a/Tests/Unit/DSCResources/.tests.header.ps1
+++ b/Tests/Unit/DSCResources/.tests.header.ps1
@@ -1,3 +1,9 @@
 # Unit Test Header
-$script:moduleRoot = Split-Path -Parent (Split-Path -Parent ( Split-Path -Parent $PSScriptRoot ) )
-Import-Module (Join-Path -Path $moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1') -Force
+$script:dscModuleName = 'PowerStig'
+$script:projectRoot = Split-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent) -Parent
+$script:buildOutput = Join-Path -Path $projectRoot -ChildPath 'output'
+$script:manifestPath = (Get-ChildItem -Path $buildOutput -Filter 'PowerStig.psd1' -Recurse).FullName
+$script:moduleRoot = Split-Path -Path $manifestPath -Parent
+
+Import-Module -Name (Join-Path -Path $projectRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1') -Force
+Import-Module -Name (Join-Path -Path $moduleRoot -ChildPath 'DscResources\helper.psm1')
diff --git a/Tests/Unit/DSCResources/Composite.tests.ps1 b/Tests/Unit/DSCResources/Composite.tests.ps1
index f4a13ebb0..24a2b7155 100644
--- a/Tests/Unit/DSCResources/Composite.tests.ps1
+++ b/Tests/Unit/DSCResources/Composite.tests.ps1
@@ -1,7 +1,6 @@
-$script:DSCModuleName = 'PowerStig'
-$script:moduleRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
-Import-Module (Join-Path -Path $moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1') -Force
-$manifestPath = "$script:moduleRoot\$script:DSCModuleName.psd1"
+# DscResource Unit Test Header
+. $PSScriptRoot\.tests.header.ps1
+
 $Manifest = Import-PowerShellDataFile -Path $manifestPath
 
 Describe 'Common Tests - Configuration Module Requirements' {
@@ -64,10 +63,10 @@ Describe 'Common Tests - Configuration Module Requirements' {
 }
 Describe 'Composite Resources' {
 
-    $manifestDscResourceList = $Manifest.DscResourcesToExport
+    $manifestDscResourceList = $Manifest.DscResourcesToExport | Sort-Object -Descending
 
     $moduleDscResourceList = Get-ChildItem -Path "$($script:moduleRoot)\DscResources" -Directory -Exclude 'Resources' |
-                        Select-Object -Property BaseName -ExpandProperty BaseName
+                        Select-Object -Property BaseName -ExpandProperty BaseName | Sort-Object -Descending
 
     It 'Should have all module resources listed in the manifest' {
         $manifestDscResourceList | Should Be $moduleDscResourceList
diff --git a/Tests/Unit/DSCResources/helper.tests.ps1 b/Tests/Unit/DSCResources/helper.tests.ps1
index 58da4c178..24b01b6fc 100644
--- a/Tests/Unit/DSCResources/helper.tests.ps1
+++ b/Tests/Unit/DSCResources/helper.tests.ps1
@@ -1,4 +1,5 @@
-[String] $script:moduleRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
+# DscResource Unit Test Header
+. $PSScriptRoot\.tests.header.ps1
 
 Import-Module -Name (Join-Path -Path $moduleRoot -ChildPath 'DscResources\helper.psm1')
 
diff --git a/Tests/Unit/DSCResources/windows.Registry.config.ps1 b/Tests/Unit/DSCResources/windows.Registry.config.ps1
index cfde183a2..4b1aae78d 100644
--- a/Tests/Unit/DSCResources/windows.Registry.config.ps1
+++ b/Tests/Unit/DSCResources/windows.Registry.config.ps1
@@ -1,14 +1,17 @@
+# DscResource Unit Test Header
+. $PSScriptRoot\.tests.header.ps1
+
 configuration Registry_config
 {
     param
     ( )
 
-    Import-Module $PSScriptRoot\..\..\..\DscResources\helper.psm1 -Force
+    Import-Module $moduleRoot\DscResources\helper.psm1 -Force
     Import-DscResource -ModuleName GPRegistryPolicyDsc -ModuleVersion 1.2.0
     Import-DscResource -ModuleName PSDscResources -ModuleVersion 2.10.0.0
 
     Node localhost
     {
-        . $PSScriptRoot\..\..\..\DscResources\Resources\windows.Registry.ps1
+        . $moduleRoot\DscResources\Resources\windows.Registry.ps1
     }
 }
diff --git a/Tests/Unit/DSCResources/windows.Registry.tests.ps1 b/Tests/Unit/DSCResources/windows.Registry.tests.ps1
index 414f46e0b..5bf3df569 100644
--- a/Tests/Unit/DSCResources/windows.Registry.tests.ps1
+++ b/Tests/Unit/DSCResources/windows.Registry.tests.ps1
@@ -1,4 +1,3 @@
-
 $ruleList = @(
     @{
         testXml   = [xml]'<Rule Id="V-1000" severity="low" title="Registry - DWORD Test" dscresource="Registry">
diff --git a/Tests/Unit/Module/.tests.footer.ps1 b/Tests/Unit/Module/.tests.footer.ps1
index 7a5539257..0a3525e4c 100644
--- a/Tests/Unit/Module/.tests.footer.ps1
+++ b/Tests/Unit/Module/.tests.footer.ps1
@@ -1,10 +1,12 @@
-
+# footer script cleaning up test scripts test data
 if ((Get-PSCallStack)[1].Command -notmatch 'Stig\.')
 {
     # Cleanup convert module tests
     Remove-Variable STIGSettings -Scope Global
 }
-else
+
+$dynamicClassImport = Join-Path -Path $PSScriptRoot -ChildPath '..\.DynamicClassImport'
+if (Test-Path -Path $dynamicClassImport)
 {
-    # Cleanup Stig module tests
-}
+    Remove-Item -Path $dynamicClassImport -Force -Recurse -Confirm:$false
+}
\ No newline at end of file
diff --git a/Tests/Unit/Module/.tests.header.ps1 b/Tests/Unit/Module/.tests.header.ps1
index 87e08882a..8bc0326bb 100644
--- a/Tests/Unit/Module/.tests.header.ps1
+++ b/Tests/Unit/Module/.tests.header.ps1
@@ -1,11 +1,91 @@
+# Unit Test Header
+$script:projectRoot = Split-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent) -Parent
+$script:buildOutput = Join-Path -Path $script:projectRoot -ChildPath 'output'
+$script:manifestPath = (Get-ChildItem -Path $script:buildOutput -Filter 'PowerStig.psd1' -Recurse)
+$script:moduleRoot = Split-Path -Path ($script:manifestPath).FullName -Parent
+$psStackCommand = (Get-PSCallStack)[1].Command -replace '\.tests\.ps1'
+if ($psStackCommand -ne 'Convert.CommonTests.ps1')
+{
+    $global:moduleName = $psStackCommand
+    $script:modulePath = "$($script:moduleRoot)$(($PSScriptRoot -split 'Unit')[1])\$global:moduleName\$($global:moduleName).psm1"
+}
 
-$script:moduleRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
-$global:moduleName = (Get-PSCallStack)[1].Command -replace '\.tests\.ps1', ''
-# TODO $script:moduleName can be removed after all tests are migrated to global
-$script:moduleName = (Get-PSCallStack)[1].Command -replace '\.tests\.ps1', ''
-$script:modulePath = "$($script:moduleRoot)$(($PSScriptRoot -split 'Unit')[1])\$global:moduleName\$($global:moduleName).psm1"
+Import-Module -Name (Join-Path -Path $script:projectRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1') -Force -Global
 
-Import-Module -Name (Join-Path -Path $script:moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1') -Force -Global
+<#
+    if the \.DynamicClassImport folder does not exist create it. This folder is used to import class based
+    modules specific to a PowerSTIG build version. The challenge is the 'using module' statement will not
+    allow variables to be passed to it. The output/PowerSTIG folder will have a new version of the build after
+    the build script is executed, i.e.: .\output\PowerSTIG\4.4.0\<module files>. Therefore the using statement
+    has to be dynamically created with a static path and loaded via dot sourcing.
+#>
+$dynamicClassImportPath = Join-Path -Path $PSScriptRoot -ChildPath '..\.DynamicClassImport'
+if ((Test-Path -Path $dynamicClassImportPath) -eq $false)
+{
+    New-Item -Path $dynamicClassImportPath -ItemType Directory
+}
+
+$setDynamicClassFileParams = @{
+    PowerStigBuildPath  = $script:moduleRoot
+}
+
+switch ($psStackCommand)
+{
+    'Common'
+    {
+        $destinationPath = Join-Path -Path $PSScriptRoot -ChildPath '..\.DynamicClassImport\Common.ps1'
+        [void] $setDynamicClassFileParams.Add('DestinationPath', $destinationPath)
+        [void] $setDynamicClassFileParams.Add('ClassModuleFileName', 'Common.psm1')
+    }
+
+    'Convert.CommonTests.ps1'
+    {
+        $destinationPath = Join-Path -Path $PSScriptRoot -ChildPath '..\.DynamicClassImport\Rule.ps1'
+        [void] $setDynamicClassFileParams.Add('DestinationPath', $destinationPath)
+        [void] $setDynamicClassFileParams.Add('ClassModuleFileName', 'Rule.psm1')
+    }
+
+    'HardCodedRule'
+    {
+        $destinationPath = Join-Path -Path $PSScriptRoot -ChildPath '..\.DynamicClassImport\ConvertFactory.ps1'
+        [void] $setDynamicClassFileParams.Add('DestinationPath', $destinationPath)
+        [void] $setDynamicClassFileParams.Add('ClassModuleFileName', 'ConvertFactory.psm1')
+    }
+
+    'Rule'
+    {
+        $destinationPath = Join-Path -Path $PSScriptRoot -ChildPath '..\.DynamicClassImport\Rule.ps1'
+        [void] $setDynamicClassFileParams.Add('DestinationPath', $destinationPath)
+        [void] $setDynamicClassFileParams.Add('ClassModuleFileName', @('Rule.psm1', 'ConvertFactory.psm1'))
+    }
+
+    'STIG.Checklist'
+    {
+        $functionCheckListFile = Join-Path -Path $script:moduleRoot -ChildPath '\Module\STIG\Functions.Checklist.ps1'
+        . $functionCheckListFile
+    }
+
+    'STIG'
+    {
+        $destinationPath = Join-Path -Path $PSScriptRoot -ChildPath '..\.DynamicClassImport\Convert.Main.ps1'
+        [void] $setDynamicClassFileParams.Add('DestinationPath', $destinationPath)
+        [void] $setDynamicClassFileParams.Add('ClassModuleFileName', 'Convert.Main.psm1')
+    }
+
+    default
+    {
+        $ruleFile = '{0}.Convert' -f $PSItem
+        $destinationPath = Join-Path -Path $PSScriptRoot -ChildPath ('..\.DynamicClassImport\{0}.ps1' -f $ruleFile)
+        [void] $setDynamicClassFileParams.Add('DestinationPath', $destinationPath)
+        [void] $setDynamicClassFileParams.Add('ClassModuleFileName', ('{0}.psm1' -f $ruleFile))
+    }
+}
+
+if ($global:moduleName -ne 'STIG.Checklist')
+{
+    Set-DynamicClassFile @setDynamicClassFileParams
+    . $setDynamicClassFileParams.DestinationPath
+}
 
 <#
     Several classes check for duplicate rules against a global variable stigSettings.
diff --git a/Tests/Unit/Module/AccountPolicyRule.tests.ps1 b/Tests/Unit/Module/AccountPolicyRule.tests.ps1
index 2504b094b..249ac64a3 100644
--- a/Tests/Unit/Module/AccountPolicyRule.tests.ps1
+++ b/Tests/Unit/Module/AccountPolicyRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.AccountPolicy\Convert\AccountPolicyRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/AuditPolicyRule.tests.ps1 b/Tests/Unit/Module/AuditPolicyRule.tests.ps1
index dd808688b..4a0810888 100644
--- a/Tests/Unit/Module/AuditPolicyRule.tests.ps1
+++ b/Tests/Unit/Module/AuditPolicyRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.AuditPolicy\Convert\AuditPolicyRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/AuditSettingRule.tests.ps1 b/Tests/Unit/Module/AuditSettingRule.tests.ps1
index 5f6897498..f13d1bac5 100644
--- a/Tests/Unit/Module/AuditSettingRule.tests.ps1
+++ b/Tests/Unit/Module/AuditSettingRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.AuditSetting\Convert\AuditSettingRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/Common.tests.ps1 b/Tests/Unit/Module/Common.tests.ps1
index 0cb18da6d..7b592de8f 100644
--- a/Tests/Unit/Module/Common.tests.ps1
+++ b/Tests/Unit/Module/Common.tests.ps1
@@ -1,18 +1,20 @@
-using module .\..\..\..\Module\Common\Common.psm1
+#region Header
 . $PSScriptRoot\.tests.header.ps1
-# Header
-#region Enum Tests
+#endregion
+
 <#
-        a list of enums in the script that is used in a "burn down" manner. When an enum is processed
-        it is removed from the list, The last test will be to verify that all of the enums have
-        been tested
-    #>
+    a list of enums in the script that is used in a "burn down" manner. When an enum is processed
+    it is removed from the list, The last test will be to verify that all of the enums have
+    been tested
+#>
 $enumDiscovered = New-Object System.Collections.ArrayList
-# Select each line that starts with enum to count the number of enum's in the file
 
+# Select each line that starts with enum to count the number of enum's in the file
 $enumListString = ( Get-Content $modulePath | Select-String "^Enum " )
+
 # Add each enum that is found to the array
 $enumListString | Foreach-Object { $enumDiscovered.add( ( $_ -split " " )[1].ToString().ToLower() ) | Out-Null }
+
 # Get a count to to use in a final test to validate enum test coverage
 [int] $enumTestCount = $enumDiscovered.Count
 
diff --git a/Tests/Unit/Module/Convert.CommonTests.ps1 b/Tests/Unit/Module/Convert.CommonTests.ps1
index 97b502168..6355a5fab 100644
--- a/Tests/Unit/Module/Convert.CommonTests.ps1
+++ b/Tests/Unit/Module/Convert.CommonTests.ps1
@@ -1,4 +1,7 @@
-using module .\..\..\..\Module\Rule\Rule.psm1
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
 <#
     The convert common tests loop through the test data that is provided in the
     form of a hashtable.
@@ -12,13 +15,14 @@ using module .\..\..\..\Module\Rule\Rule.psm1
 #>
 
 # Get the rule element with the checkContent injected into it
-$stigRule = Get-TestStigRule -CheckContent $testRule.checkContent -ReturnGroupOnly
+$stigRule = Get-TestStigRule -CheckContent $testRule.CheckContent -ReturnGroupOnly -FixText $testRule.FixText
+
 # Create an instance of the convert class that is currently being tested
 $convertedRule = New-Object -TypeName ($global:moduleName + 'Convert') -ArgumentList $stigRule
 
 Describe "$($convertedRule.GetType().Name) Class Instance" {
     # Only run the base class test once
-    If ($count -le 0)
+    if ($count -le 0)
     {
         It "Should have a BaseType of $moduleName" {
             $convertedRule.GetType().BaseType.ToString() | Should Be $moduleName
@@ -62,18 +66,21 @@ Describe "$($convertedRule.GetType().Name) Class Instance" {
         # Test that each property was properly extracted from the test checkContent
         foreach ($property in $propertyList)
         {
-            It "Should return the $Property" {
-                # Can't test a null property type, only that the property is null
-                if ($null -ne $testRule.$property)
-                {
-                    # Some properties are complex types that need to be serialized for comparison
-                    if ($testRule.$property.GetType().BaseType.Name -eq 'Array')
+            if ($property -ne "FixText")
+            {
+                It "Should return the $Property" {
+                    # Can't test a null property type, only that the property is null
+                    if ($null -ne $testRule.$property)
                     {
-                        $convertedRule.$property = $convertedRule.$property | ConvertTo-Json
-                        $testRule.$property = $testRule.$property | ConvertTo-Json
+                        # Some properties are complex types that need to be serialized for comparison
+                        if ($testRule.$property.GetType().BaseType.Name -eq 'Array')
+                        {
+                            $convertedRule.$property = $convertedRule.$property | ConvertTo-Json
+                            $testRule.$property = $testRule.$property | ConvertTo-Json
+                        }
                     }
+                    $convertedRule.$property | Should Be $testRule.$property
                 }
-                $convertedRule.$property | Should Be $testRule.$property
             }
             # Remove the property from the list of tested properties
             $ruleClassPropertyTestList.Remove($property)
diff --git a/Tests/Unit/Module/DnsServerRootHintRule.tests.ps1 b/Tests/Unit/Module/DnsServerRootHintRule.tests.ps1
index 6e7605b6e..ee9f53137 100644
--- a/Tests/Unit/Module/DnsServerRootHintRule.tests.ps1
+++ b/Tests/Unit/Module/DnsServerRootHintRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.DnsServerRootHint\Convert\DnsServerRootHintRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/DnsServerSettingRule.tests.ps1 b/Tests/Unit/Module/DnsServerSettingRule.tests.ps1
index fc21ca7f8..fff0b011c 100644
--- a/Tests/Unit/Module/DnsServerSettingRule.tests.ps1
+++ b/Tests/Unit/Module/DnsServerSettingRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.DnsServerSetting\Convert\DnsServerSettingRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/DocumentRule.tests.ps1 b/Tests/Unit/Module/DocumentRule.tests.ps1
index 43814348b..60505c9ca 100644
--- a/Tests/Unit/Module/DocumentRule.tests.ps1
+++ b/Tests/Unit/Module/DocumentRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.Document\Convert\DocumentRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/FileContentRule.tests.ps1 b/Tests/Unit/Module/FileContentRule.tests.ps1
index 52fba3b5a..27b63ca4e 100644
--- a/Tests/Unit/Module/FileContentRule.tests.ps1
+++ b/Tests/Unit/Module/FileContentRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.FileContent\Convert\FileContentRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/GroupRule.tests.ps1 b/Tests/Unit/Module/GroupRule.tests.ps1
index 23cce1b38..5df2c32bb 100644
--- a/Tests/Unit/Module/GroupRule.tests.ps1
+++ b/Tests/Unit/Module/GroupRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.Group\Convert\GroupRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/HardCodedRule.tests.ps1 b/Tests/Unit/Module/HardCodedRule.tests.ps1
index 2557c64ea..aefe0ab37 100644
--- a/Tests/Unit/Module/HardCodedRule.tests.ps1
+++ b/Tests/Unit/Module/HardCodedRule.tests.ps1
@@ -1,12 +1,10 @@
 #region Header
-using module .\..\..\..\Module\Rule\Convert\ConvertFactory.psm1
-using module .\..\..\..\Module\Rule.HardCoded\Convert\HardCodedRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
 try
 {
-    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+    InModuleScope -ModuleName ConvertFactory {
         #region Test Setup
         $testRuleListSingle = @(
             @{
@@ -279,6 +277,7 @@ try
 
             foreach ($splitRule in $testRuleListSplit)
             {
+
                 Context "Hard Coded Split Rules (CheckContent): $($splitRule.CheckContent)" {
                     <#
                         Generate XML with a temp check content block.
diff --git a/Tests/Unit/Module/IISLoggingRule.tests.ps1 b/Tests/Unit/Module/IISLoggingRule.tests.ps1
index aebdee01f..72b90bddb 100644
--- a/Tests/Unit/Module/IISLoggingRule.tests.ps1
+++ b/Tests/Unit/Module/IISLoggingRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.IISLogging\Convert\IISLoggingRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/ManualRule.tests.ps1 b/Tests/Unit/Module/ManualRule.tests.ps1
index 4333453bc..7d6d87450 100644
--- a/Tests/Unit/Module/ManualRule.tests.ps1
+++ b/Tests/Unit/Module/ManualRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.Manual\Convert\ManualRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/MimeTypeRule.tests.ps1 b/Tests/Unit/Module/MimeTypeRule.tests.ps1
index e43e533fd..6edbff12e 100644
--- a/Tests/Unit/Module/MimeTypeRule.tests.ps1
+++ b/Tests/Unit/Module/MimeTypeRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.MimeType\Convert\MimeTypeRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/PermissionRule.tests.ps1 b/Tests/Unit/Module/PermissionRule.tests.ps1
index 68475f20e..d730862ae 100644
--- a/Tests/Unit/Module/PermissionRule.tests.ps1
+++ b/Tests/Unit/Module/PermissionRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.Permission\Convert\PermissionRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/ProcessMitigationRule.tests.ps1 b/Tests/Unit/Module/ProcessMitigationRule.tests.ps1
index 87ec483ca..4257a45bb 100644
--- a/Tests/Unit/Module/ProcessMitigationRule.tests.ps1
+++ b/Tests/Unit/Module/ProcessMitigationRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.ProcessMitigation\Convert\ProcessMitigationRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/RegistryRule.tests.ps1 b/Tests/Unit/Module/RegistryRule.tests.ps1
index 3b4a03940..27f6f1d2c 100644
--- a/Tests/Unit/Module/RegistryRule.tests.ps1
+++ b/Tests/Unit/Module/RegistryRule.tests.ps1
@@ -1,8 +1,19 @@
 #region Header
-using module .\..\..\..\Module\Rule.Registry\Convert\RegistryRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
+# Data files
+if ($null -eq (Get-Variable -Name SingleLine* -Scope Global))
+{
+    $dataFilePath = Join-Path -Path $script:moduleRoot -ChildPath 'Module\Rule\Convert'
+    $supportFiles = (Get-ChildItem -Path $dataFilePath -Filter 'Data.*.ps1').FullName
+    foreach ($file in $supportFiles)
+    {
+        . $file
+    }
+}
+#endregion
+
 try
 {
     InModuleScope -ModuleName "$($global:moduleName).Convert" {
diff --git a/Tests/Unit/Module/Rule.tests.ps1 b/Tests/Unit/Module/Rule.tests.ps1
index 240acc62e..9775446a4 100644
--- a/Tests/Unit/Module/Rule.tests.ps1
+++ b/Tests/Unit/Module/Rule.tests.ps1
@@ -1,11 +1,10 @@
 #region Header
-using module .\..\..\..\Module\Rule\Rule.psm1
-using module .\..\..\..\Module\Rule\Convert\ConvertFactory.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    InModuleScope -ModuleName $script:moduleName {
+    InModuleScope -ModuleName $global:moduleName {
         #region Test Setup
         $stig = [Rule]::new( (Get-TestStigRule -ReturnGroupOnly), $true )
         $script:moduleRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
@@ -113,12 +112,11 @@ try
                 }
             }
         }
-
         #endregion
-        #region Convert Factory
+    }
 
+    InModuleScope -ModuleName ConvertFactory {
         Describe 'Convert Factory' {
-
             Context 'AccountPolicyRule' {
                 $checkContent = 'Run "gpedit.msc".
 
@@ -134,7 +132,7 @@ try
             }
 
             Context 'AuditPolicyRule' {
-        $checkContent = 'Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective.
+                $checkContent = 'Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective.
 
                 Use the AuditPol tool to review the current Audit Policy configuration:
                 -Open a Command Prompt with elevated privileges ("Run as Administrator").
@@ -344,7 +342,6 @@ try
                 }
             }
         }
-        #endregion
     }
 }
 finally
diff --git a/Tests/Unit/Module/STIG.Checklist.tests.ps1 b/Tests/Unit/Module/STIG.Checklist.tests.ps1
index 8e8d32f7d..9a5eb20c6 100644
--- a/Tests/Unit/Module/STIG.Checklist.tests.ps1
+++ b/Tests/Unit/Module/STIG.Checklist.tests.ps1
@@ -1,4 +1,6 @@
-. $PSScriptRoot\..\..\..\Module\STIG\Functions.Checklist.ps1
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
 
 Describe 'New-StigCheckList' {
 
diff --git a/Tests/Unit/Module/STIG.tests.ps1 b/Tests/Unit/Module/STIG.tests.ps1
index 8d22c8960..cf181ffad 100644
--- a/Tests/Unit/Module/STIG.tests.ps1
+++ b/Tests/Unit/Module/STIG.tests.ps1
@@ -1,11 +1,9 @@
 #region Header
-using module .\..\..\..\Module\STIG\Convert\Convert.Main.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
+
 try
 {
-    #region Functions
-
     Describe 'Split-StigXccdf' {
 
         $sampleXccdfFileName = 'U_Windows_Server_2016{0}_STIG_V1R1_Manual-xccdf.xml'
@@ -37,6 +35,7 @@ try
             }
         }
     }
+
     Describe 'Get-StigVersionNumber' {
         $majorVersionNumber = '1'
         $minorVersionNumber = '5'
@@ -48,6 +47,7 @@ try
                 Should Be "$majorVersionNumber.$minorVersionNumber"
         }
     }
+
     Describe 'Get-PowerStigFileList' {
         $majorVersionNumber = '1'
         $minorVersionNumber = '5'
@@ -81,6 +81,7 @@ try
         }
         #>
     }
+
     Describe 'Split-BenchmarkId' {
         $sampleStrings = [ordered]@{
             'SQLServer' = @(
@@ -249,14 +250,16 @@ try
             }
         }
     }
+
     Describe 'Conversion Status' {
         It 'Should not contain conversionstatus="fail" in any processed STIG' {
-            $selectStringResults = Select-String -Pattern 'conversionstatus="fail"' -Path "$PSScriptRoot\..\..\..\StigData\Processed\*.xml"
+            $processedStigDataPath = Join-Path -Path $script:moduleRoot -ChildPath 'StigData\Processed\*.xml'
+            $selectStringResults = Select-String -Pattern 'conversionstatus="fail"' -Path $processedStigDataPath
             $selectStringResults | Should Be $null
         }
     }
-    #endregion
 }
+
 finally
 {
     . $PSScriptRoot\.tests.footer.ps1
diff --git a/Tests/Unit/Module/SecurityOptionRule.tests.ps1 b/Tests/Unit/Module/SecurityOptionRule.tests.ps1
index 14486623f..633728643 100644
--- a/Tests/Unit/Module/SecurityOptionRule.tests.ps1
+++ b/Tests/Unit/Module/SecurityOptionRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.SecurityOption\Convert\SecurityOptionRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/ServiceRule.tests.ps1 b/Tests/Unit/Module/ServiceRule.tests.ps1
index 4b2a6f53b..3cbea09ed 100644
--- a/Tests/Unit/Module/ServiceRule.tests.ps1
+++ b/Tests/Unit/Module/ServiceRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.Service\Convert\ServiceRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/SqlScriptQueryRule.tests.ps1 b/Tests/Unit/Module/SqlScriptQueryRule.tests.ps1
index c4bf150a0..307d659af 100644
--- a/Tests/Unit/Module/SqlScriptQueryRule.tests.ps1
+++ b/Tests/Unit/Module/SqlScriptQueryRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.SqlScriptQuery\Convert\SqlScriptQueryRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/SslSettingsRule.tests.ps1 b/Tests/Unit/Module/SslSettingsRule.tests.ps1
index bc2dff09c..44d1018bc 100644
--- a/Tests/Unit/Module/SslSettingsRule.tests.ps1
+++ b/Tests/Unit/Module/SslSettingsRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.SslSettings\Convert\SslSettingsRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/UserRightRule.tests.ps1 b/Tests/Unit/Module/UserRightRule.tests.ps1
index 12ab4f584..62226c96f 100644
--- a/Tests/Unit/Module/UserRightRule.tests.ps1
+++ b/Tests/Unit/Module/UserRightRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.UserRight\Convert\UserRightRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/VsphereAcceptanceLevelRule.tests.ps1 b/Tests/Unit/Module/VsphereAcceptanceLevelRule.tests.ps1
new file mode 100644
index 000000000..4677eab1f
--- /dev/null
+++ b/Tests/Unit/Module/VsphereAcceptanceLevelRule.tests.ps1
@@ -0,0 +1,46 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+try
+{
+    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+        #region Test Setup
+        $testRuleList = @(
+            @{
+                Level = 'PartnerSupported'
+                OrganizationValueRequired = $false
+                CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under "Host Image Profile Acceptance Level" view the acceptance level.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                $esxcli = Get-EsxCli
+                $esxcli.software.acceptance.get()
+
+                If the acceptance level is CommunitySupported, this is a finding.'
+                FixText = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under "Host Image Profile Acceptance Level" click Edit… and use the pull-down selection, set the acceptance level to be VMwareCertified, VMwareAccepted, or PartnerSupported.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                $esxcli = Get-EsxCli
+                $esxcli.software.acceptance.Set("PartnerSupported")
+
+                Note: VMwareCertified or VMwareAccepted may be substituted for PartnerSupported, depending upon local requirements.'
+            }
+        )
+        #endregion
+
+        foreach ($testRule in $testRuleList)
+        {
+            . $PSScriptRoot\Convert.CommonTests.ps1
+        }
+    }
+}
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Unit/Module/VsphereAdvancedSettingsRule.tests.ps1 b/Tests/Unit/Module/VsphereAdvancedSettingsRule.tests.ps1
new file mode 100644
index 000000000..1604ad98b
--- /dev/null
+++ b/Tests/Unit/Module/VsphereAdvancedSettingsRule.tests.ps1
@@ -0,0 +1,66 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+try
+{
+    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+        #region Test Setup
+        $testRuleList = @(
+            @{
+                AdvancedSettings = "'DCUI.Access' = 'root'"
+                OrganizationValueRequired = $false
+                CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the DCUI.Access value and verify only the root user is listed.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+                Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.
+
+                If the DCUI.Access is not restricted to root, this is a finding.
+
+                Note: This list is only for local user accounts and should only contain the root user.
+
+                For environments that do not use vCenter server to manage ESXi, this is not applicable.'
+                FixText = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Advanced System Settings. Click Edit and select the DCUI.Access value and configure it to root.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+                Get-VMHost | Get-AdvancedSetting -Name DCUI.Access | Set-AdvancedSetting -Value "root"'
+            },
+            @{
+                AdvancedSettings = "'UserVars.ESXiShellInteractiveTimeOut' = '600'"
+                OrganizationValueRequired = $false
+                CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Advanced System Settings. Select the UserVars.ESXiShellInteractiveTimeOut value and verify it is set to 600 (10 Minutes).
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+                Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut
+
+                If the UserVars.ESXiShellInteractiveTimeOut setting is not set to 600, this is a finding.'
+                FixText = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Advanced System Settings. Click Edit and select the UserVars.ESXiShellInteractiveTimeOut value and configure it to 600.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut | Set-AdvancedSetting -Value 600'
+            }
+        )
+        #endregion
+
+        foreach ($testRule in $testRuleList)
+        {
+            . $PSScriptRoot\Convert.CommonTests.ps1
+        }
+    }
+}
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Unit/Module/VsphereKernelActiveDumpPartitionRule.tests.ps1 b/Tests/Unit/Module/VsphereKernelActiveDumpPartitionRule.tests.ps1
new file mode 100644
index 000000000..79edaad06
--- /dev/null
+++ b/Tests/Unit/Module/VsphereKernelActiveDumpPartitionRule.tests.ps1
@@ -0,0 +1,57 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+try
+{
+    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+        #region Test Setup
+        $testRuleList = @(
+            @{
+                Enabled = '$true'
+                OrganizationValueRequired = $false
+                CheckContent = 'From the vSphere Web Client select the ESXi Host and right click. If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                $esxcli = Get-EsxCli
+                $esxcli.system.coredump.partition.get()
+                $esxcli.system.coredump.network.get()
+
+                The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables.
+
+                If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.'
+                FixText = 'From the vSphere Web Client select the ESXi Host and right click. Select the "Add Diagnostic Partition" option configure a core dump diagnostic partition.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run at least one of the following sets of commands:
+
+                To configure a core dump partition:
+
+                $esxcli = Get-EsxCli
+                #View available partitions to configure
+                $esxcli.system.coredump.partition.list()
+                $esxcli.system.coredump.partition.set($null,"PartitionName",$null,$null)
+
+                To configure a core dump collector:
+
+                $esxcli = Get-EsxCli
+                $esxcli.system.coredump.network.set($null,"vmkernel port to use",$null,"CollectorIP","CollectorPort")
+                $esxcli.system.coredump.network.set($true)'
+            }
+        )
+        #endregion
+
+        foreach ($testRule in $testRuleList)
+        {
+            . $PSScriptRoot\Convert.CommonTests.ps1
+        }
+    }
+}
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Unit/Module/VspherePortGroupSecurityRule.tests.ps1 b/Tests/Unit/Module/VspherePortGroupSecurityRule.tests.ps1
new file mode 100644
index 000000000..ac8e7c28a
--- /dev/null
+++ b/Tests/Unit/Module/VspherePortGroupSecurityRule.tests.ps1
@@ -0,0 +1,82 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+try
+{
+    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+        #region Test Setup
+        $testRuleList = @(
+            @{
+                OrganizationValueRequired = $false
+                ForgedTransmitsInherited = '$true'
+                CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualPortGroup | Get-SecurityPolicy
+
+                If the "Forged Transmits" policy is set to accept, this is a finding.'
+                FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "Forged Transmits" to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -ForgedTransmitsInherited $true'
+            },
+            @{
+                OrganizationValueRequired = $false
+                AllowPromiscuousInherited = '$true'
+                CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualPortGroup | Get-SecurityPolicy
+
+                If the "Promiscuous Mode" policy is set to accept, this is a finding.'
+                FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "Promiscuous Mode" to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -AllowPromiscuousInherited $true'
+            },
+            @{
+                OrganizationValueRequired = $false
+                MacChangesInherited = '$true'
+                CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualPortGroup | Get-SecurityPolicy
+
+                If the "MAC Address Changes" policy is set to accept, this is a finding.'
+                FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "MAC Address Changes" to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -MacChangesInherited $true'
+            }
+        )
+        #endregion
+
+        foreach ($testRule in $testRuleList)
+        {
+            . $PSScriptRoot\Convert.CommonTests.ps1
+        }
+    }
+}
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Unit/Module/VsphereServiceRule.tests.ps1 b/Tests/Unit/Module/VsphereServiceRule.tests.ps1
new file mode 100644
index 000000000..4f09d9fc9
--- /dev/null
+++ b/Tests/Unit/Module/VsphereServiceRule.tests.ps1
@@ -0,0 +1,37 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+try
+{
+    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+        #region Test Setup
+        $testRuleList = @(
+            @{
+                Key = 'TSM-SSH'
+                Policy = 'off'
+                Running = 'False'
+                OrganizationValueRequired = $false
+                CheckContent = 'From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under Services select Edit and view the "SSH" service and verify it is stopped.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+                Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"}
+
+                If the ESXi SSH service is running, this is a finding.'
+            }
+        )
+        #endregion
+
+        foreach ($testRule in $testRuleList)
+        {
+            . $PSScriptRoot\Convert.CommonTests.ps1
+        }
+    }
+}
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Unit/Module/VsphereSnmpAgentRule.tests.ps1 b/Tests/Unit/Module/VsphereSnmpAgentRule.tests.ps1
new file mode 100644
index 000000000..a5ed189ed
--- /dev/null
+++ b/Tests/Unit/Module/VsphereSnmpAgentRule.tests.ps1
@@ -0,0 +1,54 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+try
+{
+    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+        #region Test Setup
+        $testRuleList = @(
+            @{
+                Enabled = '$false'
+                OrganizationValueRequired = $false
+                CheckContent = 'From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+                Get-VMHostSnmp | Select *
+
+                or
+
+                From a console or ssh session run the follow command:
+
+                esxcli system snmp get
+
+                If SNMP is not in use and is enabled, this is a finding.
+
+                If SNMP is enabled and read only communities is set to public, this is a finding.
+
+                If SNMP is enabled and is not using v3 targets, this is a finding.
+
+                Note: SNMP v3 targets can only be viewed and configured from the esxcli command.'
+                FixText = 'To disable SNMP run the following command from a PowerCLI command prompt while connected to the ESXi Host:
+
+                Get-VMHostSnmp | Set-VMHostSnmp -Enabled $false
+
+                or
+
+                From a console or ssh session run the follow command:
+
+                esxcli system snmp set -e no
+
+                To configure SNMP for v3 targets use the "esxcli system snmp set" command set.'
+            }
+        )
+        #endregion
+
+        foreach ($testRule in $testRuleList)
+        {
+            . $PSScriptRoot\Convert.CommonTests.ps1
+        }
+    }
+}
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Unit/Module/VsphereVssSecurityRule.tests.ps1 b/Tests/Unit/Module/VsphereVssSecurityRule.tests.ps1
new file mode 100644
index 000000000..f8daa93fe
--- /dev/null
+++ b/Tests/Unit/Module/VsphereVssSecurityRule.tests.ps1
@@ -0,0 +1,82 @@
+#region Header
+. $PSScriptRoot\.tests.header.ps1
+#endregion
+
+try
+{
+    InModuleScope -ModuleName "$($global:moduleName).Convert" {
+        #region Test Setup
+        $testRuleList = @(
+            @{
+                OrganizationValueRequired = $false
+                ForgedTransmits = '$false'
+                CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualSwitch | Get-SecurityPolicy
+
+                If the "Forged Transmits" policy is set to accept, this is a finding.'
+                FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "Forged Transmits" to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -ForgedTransmits $false'
+            },
+            @{
+                OrganizationValueRequired = $false
+                AllowPromiscuous = '$false'
+                CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualSwitch | Get-SecurityPolicy
+
+                If the "Promiscuous Mode" policy is set to accept, this is a finding.'
+                FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "Promiscuous Mode" to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -AllowPromiscuous $false'
+            },
+            @{
+                OrganizationValueRequired = $false
+                MacChanges = '$false'
+                CheckContent = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualSwitch | Get-SecurityPolicy
+
+                If the "MAC Address Changes" policy is set to accept, this is a finding.'
+                FixText = 'From the vSphere Web Client go to Configure >> Networking >> Virtual Switches. For each virtual switch and port group click Edit settings and change "MAC Address Changes" to reject.
+
+                or
+
+                From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+                Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -MacChanges $false'
+            }
+        )
+        #endregion
+
+        foreach ($testRule in $testRuleList)
+        {
+            . $PSScriptRoot\Convert.CommonTests.ps1
+        }
+    }
+}
+finally
+{
+    . $PSScriptRoot\.tests.footer.ps1
+}
diff --git a/Tests/Unit/Module/WebAppPoolRule.tests.ps1 b/Tests/Unit/Module/WebAppPoolRule.tests.ps1
index 8cb8c051c..8e33690d9 100644
--- a/Tests/Unit/Module/WebAppPoolRule.tests.ps1
+++ b/Tests/Unit/Module/WebAppPoolRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.WebAppPool\Convert\WebAppPoolRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/WebConfigurationPropertyRule.tests.ps1 b/Tests/Unit/Module/WebConfigurationPropertyRule.tests.ps1
index 9596a8ce6..3414be875 100644
--- a/Tests/Unit/Module/WebConfigurationPropertyRule.tests.ps1
+++ b/Tests/Unit/Module/WebConfigurationPropertyRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.WebConfigurationProperty\Convert\WebConfigurationPropertyRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/WinEventLogRule.tests.ps1 b/Tests/Unit/Module/WinEventLogRule.tests.ps1
index 461387726..533206758 100644
--- a/Tests/Unit/Module/WinEventLogRule.tests.ps1
+++ b/Tests/Unit/Module/WinEventLogRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.WinEventLog\Convert\WinEventLogRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/Module/WindowsFeatureRule.tests.ps1 b/Tests/Unit/Module/WindowsFeatureRule.tests.ps1
index 03cd57a6d..734cd02bb 100644
--- a/Tests/Unit/Module/WindowsFeatureRule.tests.ps1
+++ b/Tests/Unit/Module/WindowsFeatureRule.tests.ps1
@@ -1,5 +1,4 @@
 #region Header
-using module .\..\..\..\Module\Rule.WindowsFeature\Convert\WindowsFeatureRule.Convert.psm1
 . $PSScriptRoot\.tests.header.ps1
 #endregion
 
diff --git a/Tests/Unit/.tests.header.ps1 b/Tests/Unit/Tools/.tests.header.ps1
similarity index 64%
rename from Tests/Unit/.tests.header.ps1
rename to Tests/Unit/Tools/.tests.header.ps1
index 39fdedd43..98817ed67 100644
--- a/Tests/Unit/.tests.header.ps1
+++ b/Tests/Unit/Tools/.tests.header.ps1
@@ -1,13 +1,10 @@
 # Unit Test Header
-$script:moduleSection = Split-Path -Path (Split-Path -Path (Get-PSCallStack)[1].ScriptName -Parent ) -Leaf
-$script:projectRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
+$script:moduleSection = Split-Path -Path (Split-Path -Path (Get-PSCallStack)[1].ScriptName -Parent) -Leaf
+$script:projectRoot = Split-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot)) -Parent
 $script:toolsRoot = Join-Path -Path $script:projectRoot -ChildPath 'Tools'
 $script:moduleName = (Get-PSCallStack)[1].Command -replace '\.tests\.ps1', ''
-
 $script:modulePath = "$($script:projectRoot)\$($script:moduleSection)\$script:moduleName\$($script:moduleName).psm1"
+$helperModulePath = Join-Path -Path $script:toolsRoot -ChildPath (Join-Path -Path 'TestHelper' -ChildPath 'TestHelper.psm1')
 
-$helperModulePath = Join-Path -Path $script:toolsRoot -ChildPath (
-        Join-Path -Path 'TestHelper' -ChildPath 'TestHelper.psm1')
-
-Import-Module -Name $helperModulePath  -Force -Global
+Import-Module -Name $helperModulePath -Force -Global
 Import-Module -Name $script:modulePath -Force
diff --git a/Tests/Unit/Tools/TestHelper.tests.ps1 b/Tests/Unit/Tools/TestHelper.tests.ps1
index 734c72e8b..899d3ae3c 100644
--- a/Tests/Unit/Tools/TestHelper.tests.ps1
+++ b/Tests/Unit/Tools/TestHelper.tests.ps1
@@ -1,5 +1,4 @@
-$unitTestRoot = Split-Path -Path $PSScriptRoot -Parent
-. "$unitTestRoot\.tests.header.ps1"
+. $PSScriptRoot\.tests.header.ps1
 
 try
 {
diff --git a/Tests/Unit/Tools/WikiPages.tests.ps1 b/Tests/Unit/Tools/WikiPages.tests.ps1
index ebb89a5fe..747179f35 100644
--- a/Tests/Unit/Tools/WikiPages.tests.ps1
+++ b/Tests/Unit/Tools/WikiPages.tests.ps1
@@ -1,5 +1,5 @@
-$unitTestRoot = Split-Path -Path $PSScriptRoot -Parent
-. "$unitTestRoot\.tests.header.ps1"
+. $PSScriptRoot\.tests.header.ps1
+
 try
 {
     InModuleScope $script:ModuleName {
diff --git a/Tools/Release/Release.psm1 b/Tools/Release/Release.psm1
index a102e0bd7..da3c55557 100644
--- a/Tools/Release/Release.psm1
+++ b/Tools/Release/Release.psm1
@@ -825,7 +825,7 @@ function Update-FileHashMarkdown
     (
         [Parameter()]
         [string[]]
-        $FileHashPath = (Join-Path -Path $PWD -ChildPath '\StigData\Processed\*.xml'),
+        $FileHashPath = (Join-Path -Path $PWD -ChildPath 'source\StigData\Processed\*.xml'),
 
         [Parameter()]
         [string]
@@ -901,11 +901,11 @@ function Update-PowerSTIGCoverageMarkdown
     (
         [Parameter()]
         [string[]]
-        $ProcessedStigPath = (Join-Path -Path $PSScriptRoot -ChildPath '..\..\StigData\Processed\*.xml'),
+        $ProcessedStigPath = (Join-Path -Path $PSScriptRoot -ChildPath '..\..\source\StigData\Processed\*.xml'),
 
         [Parameter()]
         [string]
-        $PowerStigWikiPath = (Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\PowerSTIG.wiki\StigDetails'),
+        $PowerStigWikiPath = (Join-Path -Path $PSScriptRoot -ChildPath '..\..\..\PowerSTIG.wiki\'),
 
         [Parameter()]
         [string[]]
@@ -917,7 +917,10 @@ function Update-PowerSTIGCoverageMarkdown
         throw "$(Split-Path -Path $PowerStigWikiPath) was not detected, check the path and try again."
     }
 
-    $moduleManifest = Join-Path -Path $PSScriptRoot -ChildPath '..\..\PowerStig.psd1'
+    $stigDetails = Join-Path -Path $PowerStigWikiPath -ChildPath 'StigDetails'
+    Get-ChildItem -Path $stigDetails -Recurse | Remove-Item -Recurse -Confirm:$false -Force
+
+    $moduleManifest = Join-Path -Path $PSScriptRoot -ChildPath '..\..\source\PowerStig.psd1'
     $moduleVersion = (Import-PowerShellDataFile -Path $moduleManifest).ModuleVersion
     $processedStig = Get-ChildItem -Path $ProcessedStigPath -Exclude $Exclude | Select-Object -ExpandProperty FullName
     $markdownStrings = Import-PowerShellDataFile -Path (Join-Path -Path $PSScriptRoot -ChildPath 'Data.Markdown.psd1')
@@ -939,8 +942,9 @@ function Update-PowerSTIGCoverageMarkdown
         $allStigRuleSevCount = $allStigRuleType | Foreach-Object {$stig.DISASTIG.$_.Rule} | Group-Object -Property severity -NoElement
         $automatedSevCount = $automatedRuleType | Foreach-Object {$stig.DISASTIG.$_.Rule} | Group-Object -Property severity -NoElement
         $stigDetailFileName = (Split-Path -Path $stigXml -Leaf) -replace '.xml', '.md'
-        $stigDetailFilePath = Join-Path -Path $PowerStigWikiPath -ChildPath $stigDetailFileName
+        $stigDetailFilePath = Join-Path -Path $stigDetails -ChildPath $stigDetailFileName
         $stigDetailFileLink = $markdownStrings.markdownRuleLink -f ($stigDetailFileName -replace '.md')
+        [string]$stigAutomatedRulePercentage = ([math]::Round($automatedRuleCount/$allStigRuleCount, 2) * 100)
         $stigMarkdown = $markdownStrings.markdownSummaryBody -f
             $stig.DISASTIG.stigid.Replace('_', ' ').Trim(),
             $stig.DISASTIG.fullversion.Trim(),
@@ -953,7 +957,7 @@ function Update-PowerSTIGCoverageMarkdown
             $stig.DISASTIG.description.Trim(),
             $automatedRuleCount,
             $allStigRuleCount,
-            $([math]::Round($automatedRuleCount/$allStigRuleCount, 2)*100),
+            $stigAutomatedRulePercentage,
             ($automatedSevCount | Where-Object {$_.Name -eq 'high'}).Count,
             ($allStigRuleSevCount | Where-Object {$_.Name -eq 'high'}).Count,
             ($automatedSevCount | Where-Object {$_.Name -eq 'medium'}).Count,
@@ -1009,10 +1013,10 @@ function Update-PowerSTIGCoverageMarkdown
         Set-Content -Path $stigDetailFilePath -Value $stigDetailContent.ToString().Trim() -Force
     }
 
-    $coverageSummary = Join-Path -Path $PowerStigWikiPath -ChildPath StigCoverageSummary.md
+    $coverageSummary = Join-Path -Path $stigDetails -ChildPath StigCoverageSummary.md
     Set-Content -Path $coverageSummary -Value $summaryMarkdownContent.ToString().Trim() -Force
 
-    Update-PowerSTIGCoverageSidebar -MarkdownStrings $markdownStrings
+    Update-PowerSTIGCoverageSidebar -MarkdownStrings $markdownStrings -PowerStigWikiPath $PowerStigWikiPath
 }
 
 <#
diff --git a/Tools/TestHelper/TestHelper.psm1 b/Tools/TestHelper/TestHelper.psm1
index d870cab62..be13b0de6 100644
--- a/Tools/TestHelper/TestHelper.psm1
+++ b/Tools/TestHelper/TestHelper.psm1
@@ -262,7 +262,10 @@ function Get-StigDataRootPath
     param ( )
 
     $projectRoot = Split-Path -Path (Split-Path -Path $PsScriptRoot)
-    return Join-Path -Path $projectRoot -Child 'StigData'
+    $buildOutput = Join-Path -Path $projectRoot -ChildPath 'output'
+    $manifestPath = (Get-ChildItem -Path $buildOutput -Filter 'PowerStig.psd1' -Recurse).FullName
+    $moduleRoot = Split-Path -Path $manifestPath -Parent
+    return Join-Path -Path $moduleRoot -Child 'StigData'
 }
 
 <#
@@ -493,7 +496,7 @@ function Get-DscResourceModuleInfo
     )
 
     $moduleInfo = @()
-    $modulePattern   = "(?<ModuleName>(?<=ModuleName\s)\w+(?=\s))"
+    $modulePattern   = "(?<ModuleName>(?<=ModuleName\s)\w+.\w+(?=\s))"
     $versionPatthern = "(?<ModuleVersion>(?<=ModuleVersion\s)[\d\.]+(?=$))"
 
     $importModuleCommands = Select-String -Path $Path -Pattern 'Import-DscResource' -AllMatches
@@ -509,6 +512,57 @@ function Get-DscResourceModuleInfo
     return $moduleInfo
 }
 
+<#
+    .SYNOPSIS
+        Set/Creates ps1 file with 'using module' statement in order to dynamically load
+        Rule specific classes.
+
+    .DESCRIPTION
+        Sets/Creates a ps1 file with a 'using module' statement with a specified class.
+        This function is needed for tests due to the 'using' statement accepting either
+        relative paths and/or fully qualified paths. The build process creates an output
+        folder with the current version
+
+    .PARAMETER RuleType
+        The Rule Type to set in the ps1 file.
+
+    .PARAMETER PowerSTIGBuildPath
+        The path where PowerSTIG module was created.
+
+    .PARAMETER DestinationPath
+        The path where the ps1 file containing the using statement should reside.
+#>
+function Set-DynamicClassFile
+{
+    [CmdletBinding()]
+    [OutputType()]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [string[]]
+        $ClassModuleFileName,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateScript({Test-Path -Path $_})]
+        [string]
+        $PowerStigBuildPath,
+
+        [Parameter(Mandatory = $true)]
+        [string]
+        $DestinationPath
+    )
+
+    $stringBuilder = [System.Text.StringBuilder]::new()
+    foreach ($class in $ClassModuleFileName)
+    {
+        $classModulePath = (Get-ChildItem -Path $PowerStigBuildPath -Filter $class -Recurse).FullName
+        $usingStatement = 'using module {0}' -f $classModulePath
+        [void] $stringBuilder.AppendLine($usingStatement)
+    }
+
+    Set-Content -Value $stringBuilder.ToString() -Path $DestinationPath
+}
+
 Export-ModuleMember -Function @(
     'Split-TestStrings'
     'Get-StigDataRootPath'
@@ -523,4 +577,5 @@ Export-ModuleMember -Function @(
     'Get-ValidStigVersionNumbers'
     'Test-AutomatableRuleType'
     'Get-DscResourceModuleInfo'
+    'Set-DynamicClassFile'
 )
diff --git a/appveyor.yml b/appveyor.yml
deleted file mode 100644
index 3b2bdad13..000000000
--- a/appveyor.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Notes:
-#   - Minimal appveyor.yml file is an empty file. All sections are optional.
-#   - Indent each level of configuration with 2 spaces. Do not use tabs!
-#   - All section names are case-sensitive.
-#   - Section names should be unique on each level.
-
-#---------------------------------#
-#      general configuration      #
-#---------------------------------#
-
-version: 4.0.0.{build}
-
-skip_commits:
-  files:
-   - '**/*.md'
-   - .github/*
-
-#---------------------------------#
-#      environment configuration  #
-#---------------------------------#
-
-install:
-  - ps: Write-Verbose -Message "PowerShell version $($PSVersionTable.PSVersion)" -Verbose
-  - ps: (Import-PowerShellDataFile "$env:APPVEYOR_BUILD_FOLDER\PowerStig.psd1").RequiredModules |
-        ForEach-Object { Install-Module $PSItem.moduleName -RequiredVersion $PSItem.ModuleVersion -Repository PSGallery -Scope CurrentUser -Force }
-  - git clone https://github.com/PowerShell/DscResource.Tests
-  - ps: Import-Module "$env:APPVEYOR_BUILD_FOLDER\DscResource.Tests\AppVeyor.psm1"
-  - ps: Import-Module "$env:APPVEYOR_BUILD_FOLDER\Tools\AppVeyor\AppVeyor.psm1"
-  - ps: Invoke-AppveyorInstallTask
-
-#---------------------------------#
-#      build configuration        #
-#---------------------------------#
-
-build: false
-
-#---------------------------------#
-#      test configuration         #
-#---------------------------------#
-
-test_script:
-    - ps: |
-        Invoke-AppveyorTestScriptTask -CodeCoverage -CodeCovIo -ExcludeTag @('tools')
-
-#---------------------------------#
-#      deployment configuration   #
-#---------------------------------#
-
-# Scripts to run before deployment
-before_deploy:
-  - ps: Invoke-PowerStigAppveyorAfterTestTask
-
-for:
--
-  branches:
-    only:
-      - master
-
-  deploy:
-    - provider: Environment
-      name: Test PS Gallery
-      on:
-        appveyor_repo_tag: true
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
new file mode 100644
index 000000000..13e94b634
--- /dev/null
+++ b/azure-pipelines.yml
@@ -0,0 +1,223 @@
+trigger:
+  branches:
+    include:
+    - "*"
+  paths:
+    exclude:
+    - CHANGELOG.md
+  tags:
+    include:
+    - "v*"
+    exclude:
+    - "*-*"
+
+stages:
+  - stage: Build
+    jobs:
+      - job: Package_Module
+        displayName: 'Package Module'
+        pool:
+          vmImage: 'windows-2019'
+        steps:
+          - task: GitVersion@5
+            name: gitVersion
+            displayName: 'Evaluate Next Version'
+            inputs:
+              runtime: 'core'
+              configFilePath: 'GitVersion.yml'
+
+          - task: PowerShell@2
+            name: package
+            displayName: 'Build & Package Module'
+            inputs:
+              filePath: './build.ps1'
+              arguments: '-ResolveDependency -tasks pack'
+              pwsh: true
+            env:
+              ModuleVersion: $(gitVersion.NuGetVersionV2)
+
+          - task: PublishBuildArtifacts@1
+            displayName: 'Publish Build Artifact'
+            inputs:
+              pathToPublish: 'output/'
+              artifactName: 'output'
+              publishLocation: 'Container'
+
+  - stage: Test
+    dependsOn: Build
+    jobs:
+      - job: Test_HQRM
+        displayName: 'High Quality Resource Module'
+        pool:
+          vmImage: 'windows-2019'
+        timeoutInMinutes: 0
+        steps:
+          - task: DownloadBuildArtifacts@0
+            displayName: 'Download Build Artifact'
+            inputs:
+              buildType: 'current'
+              downloadType: 'single'
+              artifactName: 'output'
+              downloadPath: '$(Build.SourcesDirectory)'
+          - task: PowerShell@2
+            name: test
+            displayName: 'Run HQRM Test'
+            inputs:
+              filePath: './build.ps1'
+              arguments: '-Tasks hqrmtest'
+              pwsh: false
+          - task: PublishTestResults@2
+            displayName: 'Publish Test Results'
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'NUnit'
+              testResultsFiles: 'output/testResults/NUnit*.xml'
+              testRunTitle: 'HQRM'
+
+      - job: Test_Unit
+        displayName: 'Unit'
+        pool:
+          vmImage: 'windows-2019'
+        timeoutInMinutes: 0
+        steps:
+          - task: DownloadBuildArtifacts@0
+            displayName: 'Download Build Artifact'
+            inputs:
+              buildType: 'current'
+              downloadType: 'single'
+              artifactName: 'output'
+              downloadPath: '$(Build.SourcesDirectory)'
+
+          - task: PowerShell@2
+            name: test
+            displayName: 'Run Unit Test'
+            inputs:
+              filePath: './build.ps1'
+              arguments: "-Tasks test -PesterScript 'tests/Unit'"
+              pwsh: false
+
+          - task: PublishTestResults@2
+            displayName: 'Publish Test Results'
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'NUnit'
+              testResultsFiles: 'output/testResults/NUnit*.xml'
+              testRunTitle: 'Unit (Windows Server Core)'
+
+          - task: PublishBuildArtifacts@1
+            displayName: 'Publish Test Artifact'
+            inputs:
+              pathToPublish: 'output/testResults/'
+              artifactName: 'testResults'
+              publishLocation: 'Container'
+
+      - job: Test_Integration
+        displayName: 'Integration'
+        pool:
+          vmImage: 'windows-2019'
+        timeoutInMinutes: 0
+        steps:
+          - task: DownloadBuildArtifacts@0
+            displayName: 'Download Build Artifact'
+            inputs:
+              buildType: 'current'
+              downloadType: 'single'
+              artifactName: 'output'
+              downloadPath: '$(Build.SourcesDirectory)'
+
+          - task: PowerShell@2
+            name: configureWinRM
+            displayName: 'Configure WinRM'
+            inputs:
+              targetType: 'inline'
+              script: 'winrm quickconfig -quiet'
+              pwsh: false
+
+          - task: PowerShell@2
+            name: test
+            displayName: 'Run Integration Test'
+            inputs:
+              filePath: './build.ps1'
+              arguments: "-Tasks test -PesterScript 'tests/Integration' -CodeCoverageThreshold 0"
+              pwsh: false
+
+          - task: PublishTestResults@2
+            displayName: 'Publish Test Results'
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'NUnit'
+              testResultsFiles: 'output/testResults/NUnit*.xml'
+              testRunTitle: 'Integration (Windows Server Core)'
+
+      - job: Code_Coverage
+        displayName: 'Publish Code Coverage'
+        dependsOn: Test_Unit
+        pool:
+          vmImage: 'ubuntu 16.04'
+        timeoutInMinutes: 0
+        steps:
+          - pwsh: |
+              $repositoryOwner,$repositoryName = $env:BUILD_REPOSITORY_NAME -split '/'
+              echo "##vso[task.setvariable variable=RepositoryOwner;isOutput=true]$repositoryOwner"
+              echo "##vso[task.setvariable variable=RepositoryName;isOutput=true]$repositoryName"
+            name: dscBuildVariable
+            displayName: 'Set Environment Variables'
+          - task: DownloadBuildArtifacts@0
+            displayName: 'Download Build Artifact'
+            inputs:
+              buildType: 'current'
+              downloadType: 'single'
+              artifactName: 'output'
+              downloadPath: '$(Build.SourcesDirectory)'
+
+          - task: DownloadBuildArtifacts@0
+            displayName: 'Download Test Artifact'
+            inputs:
+              buildType: 'current'
+              downloadType: 'single'
+              artifactName: 'testResults'
+              downloadPath: '$(Build.SourcesDirectory)/output'
+
+          - task: PublishCodeCoverageResults@1
+            displayName: 'Publish Code Coverage'
+            condition: succeededOrFailed()
+            inputs:
+              codeCoverageTool: 'JaCoCo'
+              summaryFileLocation: 'output/testResults/JaCoCo_coverage.xml'
+              pathToSources: '$(Build.SourcesDirectory)/output/$(dscBuildVariable.RepositoryName)'
+          - script: |
+              bash <(curl -s https://codecov.io/bash) -f "./output/testResults/JaCoCo_coverage.xml"
+            displayName: 'Upload to Codecov.io'
+            condition: succeededOrFailed()
+
+  - stage: Deploy
+    dependsOn: Test
+    condition: |
+      and(
+        succeeded(),
+        or(
+          eq(variables['Build.SourceBranch'], 'refs/heads/master'),
+          startsWith(variables['Build.SourceBranch'], 'refs/tags/')
+        )
+      )
+    jobs:
+      - job: Deploy_Module
+        displayName: 'Deploy Module'
+        pool:
+          vmImage: 'windows-2019'
+        steps:
+          - task: DownloadBuildArtifacts@0
+            displayName: 'Download Build Artifact'
+            inputs:
+              buildType: 'current'
+              downloadType: 'single'
+              artifactName: 'output'
+              downloadPath: '$(Build.SourcesDirectory)'
+          - task: PowerShell@2
+            name: publishRelease
+            displayName: 'Publish Release'
+            inputs:
+              filePath: './build.ps1'
+              arguments: '-tasks publish'
+            env:
+              GalleryApiToken: $(GalleryApiToken)
diff --git a/build.ps1 b/build.ps1
new file mode 100644
index 000000000..81fe87ece
--- /dev/null
+++ b/build.ps1
@@ -0,0 +1,422 @@
+<#
+
+.DESCRIPTION
+ Bootstrap and build script for PowerShell module pipeline
+
+#>
+[CmdletBinding()]
+param
+(
+    [Parameter(Position = 0)]
+    [string[]]$Tasks = '.',
+
+    [Parameter()]
+    [String]
+    $CodeCoverageThreshold = '',
+
+    [Parameter()]
+    [validateScript(
+        { Test-Path -Path $_ }
+    )]
+    $BuildConfig,
+
+    [Parameter()]
+    # A Specific folder to build the artefact into.
+    $OutputDirectory = 'output',
+
+    [Parameter()]
+    # Subdirectory name to build the module (under $OutputDirectory)
+    $BuiltModuleSubdirectory = '',
+
+    # Can be a path (relative to $PSScriptRoot or absolute) to tell Resolve-Dependency & PSDepend where to save the required modules,
+    # or use CurrentUser, AllUsers to target where to install missing dependencies
+    # You can override the value for PSDepend in the Build.psd1 build manifest
+    # This defaults to $OutputDirectory/modules (by default: ./output/modules)
+    [Parameter()]
+    $RequiredModulesDirectory = $(Join-Path 'output' 'RequiredModules'),
+
+    [Parameter()]
+    [object[]]
+    $PesterScript,
+
+    # Filter which tags to run when invoking Pester tests
+    # This is used in the Invoke-Pester.pester.build.ps1 tasks
+    [Parameter()]
+    [string[]]
+    $PesterTag,
+
+    # Filter which tags to exclude when invoking Pester tests
+    # This is used in the Invoke-Pester.pester.build.ps1 tasks
+    [Parameter()]
+    [string[]]
+    $PesterExcludeTag,
+
+    # Filter which tags to run when invoking DSC Resource tests
+    # This is used in the DscResource.Test.build.ps1 tasks
+    [Parameter()]
+    [string[]]
+    $DscTestTag,
+
+    # Filter which tags to exclude when invoking DSC Resource tests
+    # This is used in the DscResource.Test.build.ps1 tasks
+    [Parameter()]
+    [string[]]
+    $DscTestExcludeTag,
+
+    [Parameter()]
+    [Alias('bootstrap')]
+    [switch]$ResolveDependency,
+
+    [Parameter(DontShow)]
+    [AllowNull()]
+    $BuildInfo,
+
+    [Parameter()]
+    [switch]
+    $AutoRestore
+)
+
+# The BEGIN block (at the end of this file) handles the Bootstrap of the Environment before Invoke-Build can run the tasks
+# if the -ResolveDependency (aka Bootstrap) is specified, the modules are already available, and can be auto loaded
+
+process
+{
+
+    if ($MyInvocation.ScriptName -notLike '*Invoke-Build.ps1')
+    {
+        # Only run the process block through InvokeBuild (Look at the Begin block at the bottom of this script)
+        return
+    }
+
+    # Execute the Build Process from the .build.ps1 path.
+    Push-Location -Path $PSScriptRoot -StackName BeforeBuild
+
+    try
+    {
+        Write-Host -ForeGroundColor magenta "[build] Parsing defined tasks"
+
+        # Load Default BuildInfo if not provided as parameter
+        if (!$PSBoundParameters.ContainsKey('BuildInfo'))
+        {
+            try
+            {
+                if (Test-Path $BuildConfig)
+                {
+                    $ConfigFile = (Get-Item -Path $BuildConfig)
+                    Write-Host "[build] Loading Configuration from $ConfigFile"
+                    $BuildInfo = switch -Regex ($ConfigFile.Extension)
+                    {
+                        # Native Support for PSD1
+                        '\.psd1'
+                        {
+                            Import-PowerShellDataFile -Path $BuildConfig
+                        }
+                        # Support for yaml when module PowerShell-Yaml is available
+                        '\.[yaml|yml]'
+                        {
+                            Import-Module -ErrorAction Stop -Name 'powershell-yaml'
+                            ConvertFrom-Yaml -Yaml (Get-Content -Raw $ConfigFile)
+                        }
+                        # Native Support for JSON and JSONC (by Removing comments)
+                        '\.[json|jsonc]'
+                        {
+                            $JSONC = (Get-Content -Raw -Path $ConfigFile)
+                            $JSON = $JSONC -replace '(?m)\s*//.*?$' -replace '(?ms)/\*.*?\*/'
+                            # This should probably be converted to hashtable for splatting
+                            $JSON | ConvertFrom-Json
+                        }
+                        default
+                        {
+                            Write-Error "Extension '$_' not supported. using @{}"
+                            @{ }
+                        }
+                    }
+                }
+                else
+                {
+                    Write-Host -Object "Configuration file $BuildConfig not found" -ForegroundColor Red
+                    $BuildInfo = @{ }
+                }
+            }
+            catch
+            {
+                Write-Host -Object "Error loading Config $ConfigFile.`r`n Are you missing dependencies?" -ForegroundColor Yellow
+                Write-Host -Object "Make sure you run './build.ps1 -ResolveDependency -tasks noop' to restore the Required modules the first time" -ForegroundColor Yellow
+                $BuildInfo = @{ }
+                Write-Error $_.Exception.Message
+            }
+        }
+
+        # If the Invoke-Build Task Header is specified in the Build Info, set it
+        if ($BuildInfo.TaskHeader)
+        {
+            Set-BuildHeader ([scriptblock]::Create($BuildInfo.TaskHeader))
+        }
+
+        # Import Tasks from modules via their exported aliases when defined in BUild Manifest
+        # https://github.com/nightroman/Invoke-Build/tree/master/Tasks/Import#example-2-import-from-a-module-with-tasks
+        if ($BuildInfo.containsKey('ModuleBuildTasks'))
+        {
+            foreach ($Module in $BuildInfo['ModuleBuildTasks'].Keys)
+            {
+                try
+                {
+                    Write-Host -ForegroundColor DarkGray -Verbose "Importing tasks from module $Module"
+                    $LoadedModule = Import-Module $Module -PassThru -ErrorAction Stop
+                    foreach ($TaskToExport in $BuildInfo['ModuleBuildTasks'].($Module))
+                    {
+                        $LoadedModule.ExportedAliases.GetEnumerator().Where{
+                            # using -like to support wildcard
+                            Write-Host -ForegroundColor DarkGray "`t Loading $($_.Key)..."
+                            $_.Key -like $TaskToExport
+                        }.ForEach{
+                            # Dot sourcing the Tasks via their exported aliases
+                            . (Get-Alias $_.Key)
+                        }
+                    }
+                }
+                catch
+                {
+                    Write-Host -ForegroundColor Red -Object "Could not load tasks for module $Module."
+                    Write-Error $_
+                }
+            }
+        }
+
+        # Loading Build Tasks defined in the .build/ folder (will override the ones imported above if same task name)
+        Get-ChildItem -Path ".build/" -Recurse -Include *.ps1 -ErrorAction Ignore | ForEach-Object {
+            "Importing file $($_.BaseName)" | Write-Verbose
+            . $_.FullName
+        }
+
+        # Synopsis: Empty task, useful to test the bootstrap process
+        task noop { }
+
+        # Define default task sequence ("."), can be overridden in the $BuildInfo
+        task . {
+            Write-Build Yellow "No sequence currently defined for the default task"
+        }
+
+        # Load Invoke-Build task sequences/workflows from $BuildInfo
+        Write-Host -ForegroundColor DarkGray "Adding Workflow from configuration:"
+        foreach ($Workflow in $BuildInfo.BuildWorkflow.keys)
+        {
+            Write-Verbose "Creating Build Workflow '$Workflow' with tasks $($BuildInfo.BuildWorkflow.($Workflow) -join ', ')"
+            $WorkflowItem = $BuildInfo.BuildWorkflow.($Workflow)
+            if ($WorkflowItem.Trim() -match '^\{(?<sb>[\w\W]*)\}$')
+            {
+                $WorkflowItem = [ScriptBlock]::Create($Matches['sb'])
+            }
+            Write-Host -ForegroundColor DarkGray "  +-> $Workflow"
+            task $Workflow $WorkflowItem
+        }
+
+        Write-Host -ForeGroundColor magenta "[build] Executing requested workflow: $($Tasks -join ', ')"
+
+    }
+    finally
+    {
+        Pop-Location -StackName BeforeBuild
+    }
+}
+
+Begin
+{
+    # dynamically build the required module data file based on PowerStig.psd1 module manifest
+    $requiredModulesContent = @'
+@{
+    # Set up a mini virtual environment...
+    PSDependOptions             = @{
+        AddToPath  = $true
+        Target     = 'output\RequiredModules'
+        Parameters = @{
+
+        }
+    }
+
+    InvokeBuild                     = 'latest'
+    PSScriptAnalyzer                = 'latest'
+    Pester                          = '4.10.1'
+    Plaster                         = 'latest'
+    ModuleBuilder                   = '1.0.0'
+    ChangelogManagement             = 'latest'
+    Sampler                         = '0.104.0'
+    xDSCResourceDesigner            = 'latest'
+    PSPKI                           = 'latest'
+    MarkdownLinkCheck               = 'latest'
+    'DscResource.Test'              = '0.13.1'
+    'DscResource.AnalyzerRules'     = 'latest'
+    'powershell-yaml'               = 'latest'
+    # The modules below are dynamically inserted from the Begin block of .\build.ps1
+
+'@
+
+    $stringBuilder = New-Object -TypeName System.Text.StringBuilder -ArgumentList $requiredModulesContent
+    $powerStigModuleManifest = Import-PowerShellDataFile -Path (Join-Path -Path $PSScriptRoot -ChildPath '.\source\PowerStig.psd1')
+    $powerStigRequiredModule = $powerStigModuleManifest.RequiredModules
+    foreach ($requiredModule in $powerStigRequiredModule)
+    {
+        $moduleInfo = "    '{0}' = '{1}'" -f $requiredModule.ModuleName, $requiredModule.ModuleVersion
+        [void] $stringBuilder.AppendLine($moduleInfo)
+    }
+
+    [void] $stringBuilder.AppendLine("}`n`r")
+    Set-Content -Path (Join-Path -Path $PSScriptRoot -ChildPath 'RequiredModules.psd1') -Value $stringBuilder.ToString() -Encoding UTF8
+
+    # Find build config if not specified
+    if (-not $BuildConfig) {
+        $config = Get-ChildItem -Path "$PSScriptRoot\*" -Include 'build.y*ml', 'build.psd1', 'build.json*' -ErrorAction:Ignore
+        if (-not $config -or ($config -is [array] -and $config.Length -le 0)) {
+            throw "No build configuration found. Specify path via -BuildConfig"
+        }
+        elseif ($config -is [array]) {
+            if ($config.Length -gt 1) {
+                throw "More than one build configuration found. Specify which one to use via -BuildConfig"
+            }
+            $BuildConfig = $config[0]
+        }
+        else {
+            $BuildConfig = $config
+        }
+    }
+    # Bootstrapping the environment before using Invoke-Build as task runner
+
+    if ($MyInvocation.ScriptName -notLike '*Invoke-Build.ps1')
+    {
+        Write-Host -foregroundColor Green "[pre-build] Starting Build Init"
+        Push-Location $PSScriptRoot -StackName BuildModule
+    }
+
+    if ($RequiredModulesDirectory -in @('CurrentUser', 'AllUsers'))
+    {
+        # Installing modules instead of saving them
+        Write-Host -foregroundColor Green "[pre-build] Required Modules will be installed for $RequiredModulesDirectory, not saved."
+        # Tell Resolve-Dependency to use provided scope as the -PSDependTarget if not overridden in Build.psd1
+        $PSDependTarget = $RequiredModulesDirectory
+    }
+    else
+    {
+        if (-Not (Split-Path -IsAbsolute -Path $OutputDirectory))
+        {
+            $OutputDirectory = Join-Path -Path $PSScriptRoot -ChildPath $OutputDirectory
+        }
+
+        # Resolving the absolute path to save the required modules to
+        if (-Not (Split-Path -IsAbsolute -Path $RequiredModulesDirectory))
+        {
+            $RequiredModulesDirectory = Join-Path -Path $PSScriptRoot -ChildPath $RequiredModulesDirectory
+        }
+
+        # Create the output/modules folder if not exists, or resolve the Absolute path otherwise
+        if (Resolve-Path $RequiredModulesDirectory -ErrorAction SilentlyContinue)
+        {
+            Write-Debug "[pre-build] Required Modules path already exist at $RequiredModulesDirectory"
+            $RequiredModulesPath = Convert-Path $RequiredModulesDirectory
+        }
+        else
+        {
+            Write-Host -foregroundColor Green "[pre-build] Creating required modules directory $RequiredModulesDirectory."
+            $RequiredModulesPath = (New-Item -ItemType Directory -Force -Path $RequiredModulesDirectory).FullName
+        }
+
+        # Prepending $RequiredModulesPath folder to PSModulePath to resolve from this folder FIRST
+        if ($RequiredModulesDirectory -notIn @('CurrentUser', 'AllUsers') -and
+            (($Env:PSModulePath -split [io.path]::PathSeparator) -notContains $RequiredModulesDirectory))
+        {
+            Write-Host -foregroundColor Green "[pre-build] Prepending '$RequiredModulesDirectory' folder to PSModulePath"
+            $Env:PSModulePath = $RequiredModulesDirectory + [io.path]::PathSeparator + $Env:PSModulePath
+        }
+
+        # Checking if the user should -ResolveDependency
+        if ((!(Get-Module -ListAvailable powershell-yaml) -or !(Get-Module -ListAvailable InvokeBuild) -or !(Get-Module -ListAvailable PSDepend)) -and !$ResolveDependency)
+        {
+            if ($AutoRestore -or !$PSBoundParameters.ContainsKey('Tasks') -or $Tasks -contains 'build')
+            {
+                Write-Host -ForegroundColor Yellow "[pre-build] Dependency missing, running './build.ps1 -ResolveDependency -Tasks noop' for you `r`n"
+                $ResolveDependency = $true
+            }
+            else
+            {
+                Write-Warning "Some required Modules are missing, make sure you first run with the '-ResolveDependency' parameter."
+                Write-Warning "Running 'build.ps1 -ResolveDependency -Tasks noop' will pull required modules without running the build task."
+            }
+        }
+
+        if ($BuiltModuleSubdirectory)
+        {
+            if (-Not (Split-Path -IsAbsolute $BuiltModuleSubdirectory))
+            {
+                $BuildModuleOutput = Join-Path $OutputDirectory $BuiltModuleSubdirectory
+            }
+            else
+            {
+                $BuildModuleOutput = $BuiltModuleSubdirectory
+            }
+        }
+        else
+        {
+            $BuildModuleOutput = $OutputDirectory
+        }
+
+        # Prepending $BuildModuleOutput folder to PSModulePath to resolve built module from this folder
+        if (($Env:PSModulePath -split [io.path]::PathSeparator) -notContains $BuildModuleOutput)
+        {
+            Write-Host -foregroundColor Green "[pre-build] Prepending '$BuildModuleOutput' folder to PSModulePath"
+            $Env:PSModulePath = $BuildModuleOutput + [io.path]::PathSeparator + $Env:PSModulePath
+        }
+
+        # Tell Resolve-Dependency to use $RequiredModulesPath as -PSDependTarget if not overridden in Build.psd1
+        $PSDependTarget = $RequiredModulesPath
+    }
+
+    if ($ResolveDependency)
+    {
+        Write-Host -Object "[pre-build] Resolving dependencies." -foregroundColor Green
+        $ResolveDependencyParams = @{ }
+
+        # If BuildConfig is a Yaml file, bootstrap powershell-yaml via ResolveDependency
+        if ($BuildConfig -match '\.[yaml|yml]$')
+        {
+            $ResolveDependencyParams.add('WithYaml', $True)
+        }
+
+        $ResolveDependencyAvailableParams = (Get-Command -Name '.\Resolve-Dependency.ps1').parameters.keys
+        foreach ($CmdParameter in $ResolveDependencyAvailableParams)
+        {
+
+            # The parameter has been explicitly used for calling the .build.ps1
+            if ($MyInvocation.BoundParameters.ContainsKey($CmdParameter))
+            {
+                $ParamValue = $MyInvocation.BoundParameters.ContainsKey($CmdParameter)
+                Write-Debug " adding  $CmdParameter :: $ParamValue [from user-provided parameters to Build.ps1]"
+                $ResolveDependencyParams.Add($CmdParameter, $ParamValue)
+            }
+            # Use defaults parameter value from Build.ps1, if any
+            else
+            {
+                if ($ParamValue = Get-Variable -Name $CmdParameter -ValueOnly -ErrorAction Ignore)
+                {
+                    Write-Debug " adding  $CmdParameter :: $ParamValue [from default Build.ps1 variable]"
+                    $ResolveDependencyParams.add($CmdParameter, $ParamValue)
+                }
+            }
+        }
+
+        Write-Host -foregroundColor Green "[pre-build] Starting bootstrap process."
+        .\Resolve-Dependency.ps1 @ResolveDependencyParams
+    }
+
+    if ($MyInvocation.ScriptName -notLike '*Invoke-Build.ps1')
+    {
+        Write-Verbose "Bootstrap completed. Handing back to InvokeBuild."
+        if ($PSBoundParameters.ContainsKey('ResolveDependency'))
+        {
+            Write-Verbose "Dependency already resolved. Removing task"
+            $null = $PSBoundParameters.Remove('ResolveDependency')
+        }
+        Write-Host -foregroundColor Green "[build] Starting build with InvokeBuild."
+        Invoke-Build @PSBoundParameters -Task $Tasks -File $MyInvocation.MyCommand.Path
+        Pop-Location -StackName BuildModule
+        return
+    }
+}
diff --git a/build.yaml b/build.yaml
new file mode 100644
index 000000000..9ffc410a7
--- /dev/null
+++ b/build.yaml
@@ -0,0 +1,90 @@
+---
+####################################################
+#          ModuleBuilder Configuration             #
+####################################################
+
+CopyDirectories:
+  - DSCResources
+  - Module
+  - StigData
+Encoding: UTF8 # With BOM in WinPS, noBOM in PSCore.
+VersionedOutputDirectory: true
+
+####################################################
+#       Sampler Pipeline Configuration             #
+####################################################
+
+# Defining 'Workflows' (suite of InvokeBuild tasks) to be run using their alias
+BuildWorkflow:
+  '.': # "." is the default Invoke-Build workflow. It is called when no -Tasks is specified to the build.ps1
+    - build
+    - test
+
+  build:
+    - Clean
+    - Build_Module_ModuleBuilder
+    - Build_NestedModules_ModuleBuilder
+    - Create_changelog_release_output
+
+  pack:
+    - build
+    - package_module_nupkg
+
+  hqrmtest:
+    - DscResource_Tests_Stop_On_Fail
+
+  test:
+    - Pester_Tests_Stop_On_Fail
+    - Pester_if_Code_Coverage_Under_Threshold
+
+  publish:
+    - Publish_release_to_GitHub
+    - publish_module_to_gallery # runs if nuget is not available
+
+####################################################
+#       PESTER  Configuration                      #
+####################################################
+
+Pester:
+  OutputFormat: NUnitXML
+
+  # Will look at every *.ps1 & *.psm1 under ModulePath, excepts when $_.FullName -match (Join-Path $ProjectPath $ExcludeFromCodeCoverageItem)
+  ExcludeFromCodeCoverage:
+   - DSCResources
+  Script:
+   - tests/Unit
+  ExcludeTag:
+  Tag:
+  CodeCoverageThreshold: 55 # Set to 0 to bypass
+  CodeCoverageOutputFile: JaCoCo_coverage.xml
+  CodeCoverageOutputFileEncoding: ascii
+
+DscTest:
+  ExcludeTag:
+    - "Common Tests - New Error-Level Script Analyzer Rules"
+    - "Common Tests - Validate Localization"
+  Tag:
+  ExcludeSourceFile:
+    - output
+  ExcludeModuleFile:
+
+Resolve-Dependency:
+  Gallery: 'PSGallery'
+  AllowPrerelease: false
+  Verbose: false
+
+ModuleBuildTasks:
+  Sampler:
+    - '*.build.Sampler.ib.tasks'
+
+# Invoke-Build Header to be used to 'decorate' the terminal output of the tasks.
+TaskHeader: |
+  param($Path)
+  ""
+  "=" * 79
+  Write-Build Cyan "`t`t`t$($Task.Name.replace("_"," ").ToUpper())"
+  Write-Build DarkGray  "$(Get-BuildSynopsis $Task)"
+  "-" * 79
+  Write-Build DarkGray "  $Path"
+  Write-Build DarkGray "  $($Task.InvocationInfo.ScriptName):$($Task.InvocationInfo.ScriptLineNumber)"
+  ""
diff --git a/DSCResources/ActiveDirectory.md b/source/DSCResources/ActiveDirectory.md
similarity index 100%
rename from DSCResources/ActiveDirectory.md
rename to source/DSCResources/ActiveDirectory.md
diff --git a/DSCResources/Adobe/Adobe.psd1 b/source/DSCResources/Adobe/Adobe.psd1
similarity index 100%
rename from DSCResources/Adobe/Adobe.psd1
rename to source/DSCResources/Adobe/Adobe.psd1
diff --git a/DSCResources/Adobe/Adobe.schema.psm1 b/source/DSCResources/Adobe/Adobe.schema.psm1
similarity index 100%
rename from DSCResources/Adobe/Adobe.schema.psm1
rename to source/DSCResources/Adobe/Adobe.schema.psm1
diff --git a/DSCResources/DotNetFramework/DotNetFramework.psd1 b/source/DSCResources/DotNetFramework/DotNetFramework.psd1
similarity index 100%
rename from DSCResources/DotNetFramework/DotNetFramework.psd1
rename to source/DSCResources/DotNetFramework/DotNetFramework.psd1
diff --git a/DSCResources/DotNetFramework/DotNetFramework.schema.psm1 b/source/DSCResources/DotNetFramework/DotNetFramework.schema.psm1
similarity index 100%
rename from DSCResources/DotNetFramework/DotNetFramework.schema.psm1
rename to source/DSCResources/DotNetFramework/DotNetFramework.schema.psm1
diff --git a/DSCResources/FireFox/FireFox.psd1 b/source/DSCResources/FireFox/FireFox.psd1
similarity index 100%
rename from DSCResources/FireFox/FireFox.psd1
rename to source/DSCResources/FireFox/FireFox.psd1
diff --git a/DSCResources/FireFox/FireFox.schema.psm1 b/source/DSCResources/FireFox/FireFox.schema.psm1
similarity index 100%
rename from DSCResources/FireFox/FireFox.schema.psm1
rename to source/DSCResources/FireFox/FireFox.schema.psm1
diff --git a/DSCResources/IisServer/IisServer.psd1 b/source/DSCResources/IisServer/IisServer.psd1
similarity index 100%
rename from DSCResources/IisServer/IisServer.psd1
rename to source/DSCResources/IisServer/IisServer.psd1
diff --git a/DSCResources/IisServer/IisServer.schema.psm1 b/source/DSCResources/IisServer/IisServer.schema.psm1
similarity index 99%
rename from DSCResources/IisServer/IisServer.schema.psm1
rename to source/DSCResources/IisServer/IisServer.schema.psm1
index 2a7130f2e..a6e5579f8 100644
--- a/DSCResources/IisServer/IisServer.schema.psm1
+++ b/source/DSCResources/IisServer/IisServer.schema.psm1
@@ -33,7 +33,7 @@ using module ..\..\PowerStig.psm1
 configuration IisServer
 {
     [CmdletBinding()]
-    Param
+    param
     (
         [Parameter(Mandatory = $true)]
         [ValidateNotNullOrEmpty()]
diff --git a/DSCResources/IisSite/IisSite.psd1 b/source/DSCResources/IisSite/IisSite.psd1
similarity index 100%
rename from DSCResources/IisSite/IisSite.psd1
rename to source/DSCResources/IisSite/IisSite.psd1
diff --git a/DSCResources/IisSite/IisSite.schema.psm1 b/source/DSCResources/IisSite/IisSite.schema.psm1
similarity index 99%
rename from DSCResources/IisSite/IisSite.schema.psm1
rename to source/DSCResources/IisSite/IisSite.schema.psm1
index 0aa3585e5..a6c817d46 100644
--- a/DSCResources/IisSite/IisSite.schema.psm1
+++ b/source/DSCResources/IisSite/IisSite.schema.psm1
@@ -36,7 +36,7 @@ using module ..\..\PowerStig.psm1
 configuration IisSite
 {
     [CmdletBinding()]
-    Param
+    param
     (
         [Parameter(Mandatory = $true)]
         [ValidateNotNullOrEmpty()]
diff --git a/DSCResources/InternetExplorer/InternetExplorer.psd1 b/source/DSCResources/InternetExplorer/InternetExplorer.psd1
similarity index 100%
rename from DSCResources/InternetExplorer/InternetExplorer.psd1
rename to source/DSCResources/InternetExplorer/InternetExplorer.psd1
diff --git a/DSCResources/InternetExplorer/InternetExplorer.schema.psm1 b/source/DSCResources/InternetExplorer/InternetExplorer.schema.psm1
similarity index 100%
rename from DSCResources/InternetExplorer/InternetExplorer.schema.psm1
rename to source/DSCResources/InternetExplorer/InternetExplorer.schema.psm1
diff --git a/DSCResources/McAfee/McAfee.psd1 b/source/DSCResources/McAfee/McAfee.psd1
similarity index 100%
rename from DSCResources/McAfee/McAfee.psd1
rename to source/DSCResources/McAfee/McAfee.psd1
diff --git a/DSCResources/McAfee/McAfee.schema.psm1 b/source/DSCResources/McAfee/McAfee.schema.psm1
similarity index 100%
rename from DSCResources/McAfee/McAfee.schema.psm1
rename to source/DSCResources/McAfee/McAfee.schema.psm1
diff --git a/DSCResources/Office/Office.psd1 b/source/DSCResources/Office/Office.psd1
similarity index 100%
rename from DSCResources/Office/Office.psd1
rename to source/DSCResources/Office/Office.psd1
diff --git a/DSCResources/Office/Office.schema.psm1 b/source/DSCResources/Office/Office.schema.psm1
similarity index 100%
rename from DSCResources/Office/Office.schema.psm1
rename to source/DSCResources/Office/Office.schema.psm1
diff --git a/DSCResources/OracleJRE/OracleJRE.psd1 b/source/DSCResources/OracleJRE/OracleJRE.psd1
similarity index 100%
rename from DSCResources/OracleJRE/OracleJRE.psd1
rename to source/DSCResources/OracleJRE/OracleJRE.psd1
diff --git a/DSCResources/OracleJRE/OracleJRE.schema.psm1 b/source/DSCResources/OracleJRE/OracleJRE.schema.psm1
similarity index 100%
rename from DSCResources/OracleJRE/OracleJRE.schema.psm1
rename to source/DSCResources/OracleJRE/OracleJRE.schema.psm1
diff --git a/DSCResources/Resources/SqlServer.ScriptQuery.ps1 b/source/DSCResources/Resources/SqlServer.ScriptQuery.ps1
similarity index 85%
rename from DSCResources/Resources/SqlServer.ScriptQuery.ps1
rename to source/DSCResources/Resources/SqlServer.ScriptQuery.ps1
index d0e0a5007..c4520f646 100644
--- a/DSCResources/Resources/SqlServer.ScriptQuery.ps1
+++ b/source/DSCResources/Resources/SqlServer.ScriptQuery.ps1
@@ -9,12 +9,15 @@ foreach ($instance in $ServerInstance)
     {
         foreach ($db in $Database)
         {
+            $getScript = '{0} --{1}' -f $rule.GetScript, $db
+
             foreach ($rule in $rules)
             {
-                SqlScriptQuery "$(Get-ResourceTitle -Rule $rule)$instance"
+                $resourceTitle = '{0}{1}_{2}' -f (Get-ResourceTitle -Rule $rule), $instance, $db
+                SqlScriptQuery "$resourceTitle"
                 {
                     ServerInstance = $Instance
-                    GetQuery       = $rule.GetScript
+                    GetQuery       = $getScript
                     TestQuery      = $rule.TestScript
                     SetQuery       = $rule.SetScript
                     Variable       = Format-SqlScriptVariable -Database $db -Variable $($rule.Variable) -VariableValue $($rule.VariableValue)
@@ -35,7 +38,7 @@ foreach ($instance in $ServerInstance)
                     TestQuery      = $rule.TestScript
                     SetQuery       = $rule.SetScript
                     Variable       = Format-SqlScriptVariable -Variable $($rule.Variable) -VariableValue $($rule.VariableValue)
-                }   
+                }
                 continue
             }
 
diff --git a/source/DSCResources/Resources/Vsphere.VMHostNtpSettings.ps1 b/source/DSCResources/Resources/Vsphere.VMHostNtpSettings.ps1
new file mode 100644
index 000000000..3ce1b5219
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VMHostNtpSettings.ps1
@@ -0,0 +1,15 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VsphereNtpSettingsRule'
+
+foreach ($rule in $rules)
+{
+    VmHostNtpSettings (Get-ResourceTitle -Rule $rule)
+    {
+        Name       = $HostIP
+        Server     = $ServerIP
+        Credential = $Credential
+        NtpServer  = $rule.NtpServer
+    }
+}
diff --git a/source/DSCResources/Resources/Vsphere.VmHostAcceptanceLevel.ps1 b/source/DSCResources/Resources/Vsphere.VmHostAcceptanceLevel.ps1
new file mode 100644
index 000000000..9eb4d9ccd
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VmHostAcceptanceLevel.ps1
@@ -0,0 +1,15 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VsphereAcceptanceLevelRule'
+
+foreach ($rule in $rules)
+{
+    VMHostAcceptanceLevel (Get-ResourceTitle -Rule $rule)
+    {
+        Name       = $HostIP
+        Server     = $ServerIP
+        Credential = $Credential
+        Level      = $rule.Level
+    }
+}
diff --git a/source/DSCResources/Resources/Vsphere.VmHostAdvancedSettings.ps1 b/source/DSCResources/Resources/Vsphere.VmHostAdvancedSettings.ps1
new file mode 100644
index 000000000..70fe62f80
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VmHostAdvancedSettings.ps1
@@ -0,0 +1,24 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VsphereAdvancedSettingsRule'
+
+$advancedSettings = @{}
+foreach ($rule in $rules)
+{
+    $key, $value = $rule.AdvancedSettings -split ' = '
+    if ([string]::IsNullOrEmpty($key) -eq $false)
+    {
+        $advancedSettings.Add($key, $value)
+    }
+}
+
+$resourceTitle = "[$($rules.id -join ' ')]"
+
+VmHostAdvancedSettings $resourceTitle
+{
+    Name             = $HostIP
+    Server           = $ServerIP
+    Credential       = $Credential
+    AdvancedSettings = $advancedSettings
+}
diff --git a/source/DSCResources/Resources/Vsphere.VmHostSNMPAgent.ps1 b/source/DSCResources/Resources/Vsphere.VmHostSNMPAgent.ps1
new file mode 100644
index 000000000..3085b4382
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VmHostSNMPAgent.ps1
@@ -0,0 +1,15 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VsphereSnmpAgentRule'
+
+foreach ($rule in $rules)
+{
+    VmHostSnmpAgent (Get-ResourceTitle -Rule $rule)
+    {
+        Name       = $HostIP
+        Server     = $ServerIP
+        Credential = $Credential
+        Enable     = [bool] $rule.Enabled
+    }
+}
diff --git a/source/DSCResources/Resources/Vsphere.VmHostService.ps1 b/source/DSCResources/Resources/Vsphere.VmHostService.ps1
new file mode 100644
index 000000000..dc8530ab4
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VmHostService.ps1
@@ -0,0 +1,17 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VsphereServiceRule'
+
+foreach ($rule in $rules)
+{
+    VmHostService (Get-ResourceTitle -Rule $rule)
+    {
+        Name       = $HostIP
+        Server     = $ServerIP
+        Credential = $Credential
+        Running    = $rule.Running
+        Key        = $rule.Key
+        Policy     = $rule.Policy
+    }
+}
diff --git a/source/DSCResources/Resources/Vsphere.VmHostVMKernelActiveDumpPartition.ps1 b/source/DSCResources/Resources/Vsphere.VmHostVMKernelActiveDumpPartition.ps1
new file mode 100644
index 000000000..5b736778b
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VmHostVMKernelActiveDumpPartition.ps1
@@ -0,0 +1,15 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VsphereKernelActiveDumpPartitionRule'
+
+foreach ($rule in $rules)
+{
+    VmHostVMKernelActiveDumpPartition (Get-ResourceTitle -Rule $rule)
+    {
+        Name       = $HostIP
+        Server     = $ServerIP
+        Credential = $Credential
+        Enable     = [bool] $rule.Enabled
+    }
+}
diff --git a/source/DSCResources/Resources/Vsphere.VmHostVssPortGroupSecurity.ps1 b/source/DSCResources/Resources/Vsphere.VmHostVssPortGroupSecurity.ps1
new file mode 100644
index 000000000..c8b8cacf0
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VmHostVssPortGroupSecurity.ps1
@@ -0,0 +1,37 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VspherePortGroupSecurityRule'
+
+foreach ($vm in $vmGroup)
+{
+    foreach ($rule in $rules)
+    {
+        if ($rule.AllowPromiscuous)
+        {
+            $allowPromiscuousInherited = $rule.AllowPromiscuousInherited
+        }
+        if ($rule.ForgedTransmits)
+        {
+            $forgedTransmitsInherited  = $rule.ForgedTransmitsInherited
+        }
+        if ($rule.MacChanges)
+        {
+            $macChangesInherited  = $rule.MacChangesInherited
+        }
+
+        $idValue += $rule.id
+    }
+
+    VmHostVssPortGroupSecurity "$vm-$idValue"
+    {
+        Name                      = $HostIP
+        Server                    = $ServerIP
+        Credential                = $Credential
+        VmHostName                = $vm
+        AllowPromiscuousInherited = [bool] $allowPromiscuousInherited
+        ForgedTransmitsInherited  = [bool] $forgedTransmitsInherited
+        MacChangesInherited       = [bool] $macChangesInherited
+        Ensure                    = 'Present'
+    }
+}
diff --git a/source/DSCResources/Resources/Vsphere.VmHostVssSecurity.ps1 b/source/DSCResources/Resources/Vsphere.VmHostVssSecurity.ps1
new file mode 100644
index 000000000..5b13c750e
--- /dev/null
+++ b/source/DSCResources/Resources/Vsphere.VmHostVssSecurity.ps1
@@ -0,0 +1,37 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type 'VsphereVssSecurityRule'
+
+foreach ($virtualStandardSwitch in $virtualStandardSwitchGroup)
+{
+    foreach ($rule in $rules)
+    {
+        if ($rule.AllowPromiscuous)
+        {
+            $allowPromiscuous = $rule.AllowPromiscuous
+        }
+        if ($rule.ForgedTransmits)
+        {
+            $forgedTransmits = $rule.ForgedTransmits
+        }
+        if ($rule.MacChanges)
+        {
+            $macChanges = $rule.MacChanges
+        }
+
+        $idValue += $rule.id
+    }
+
+    VmHostVssSecurity "$virtualStandardSwitch-$idValue"
+    {
+        Name             = $HostIP
+        Server           = $ServerIP
+        Credential       = $Credential
+        VssName          = $VirtualStandardSwitch
+        AllowPromiscuous = [bool] $allowPromiscuous
+        ForgedTransmits  = [bool] $forgedTransmits
+        MacChanges       = [bool] $macChanges
+        Ensure           = 'Present'
+    }
+}
diff --git a/DSCResources/Resources/firefox.ReplaceText.ps1 b/source/DSCResources/Resources/firefox.ReplaceText.ps1
similarity index 100%
rename from DSCResources/Resources/firefox.ReplaceText.ps1
rename to source/DSCResources/Resources/firefox.ReplaceText.ps1
diff --git a/DSCResources/Resources/oraclejre.KeyValuePairFile.ps1 b/source/DSCResources/Resources/oraclejre.KeyValuePairFile.ps1
similarity index 100%
rename from DSCResources/Resources/oraclejre.KeyValuePairFile.ps1
rename to source/DSCResources/Resources/oraclejre.KeyValuePairFile.ps1
diff --git a/DSCResources/Resources/readme.md b/source/DSCResources/Resources/readme.md
similarity index 100%
rename from DSCResources/Resources/readme.md
rename to source/DSCResources/Resources/readme.md
diff --git a/DSCResources/Resources/windows.AccessControl.ps1 b/source/DSCResources/Resources/windows.AccessControl.ps1
similarity index 99%
rename from DSCResources/Resources/windows.AccessControl.ps1
rename to source/DSCResources/Resources/windows.AccessControl.ps1
index e3afbbf82..11f0cdc65 100644
--- a/DSCResources/Resources/windows.AccessControl.ps1
+++ b/source/DSCResources/Resources/windows.AccessControl.ps1
@@ -6,7 +6,7 @@ $rules = $stig.RuleList | Select-Rule -Type PermissionRule
 foreach ($rule in $rules)
 {
     # Determine PermissionRule type and handle
-    Switch ($rule.dscresource)
+    switch ($rule.dscresource)
     {
         'RegistryAccessEntry'
         {
diff --git a/DSCResources/Resources/windows.AccountPolicy.ps1 b/source/DSCResources/Resources/windows.AccountPolicy.ps1
similarity index 100%
rename from DSCResources/Resources/windows.AccountPolicy.ps1
rename to source/DSCResources/Resources/windows.AccountPolicy.ps1
diff --git a/DSCResources/Resources/windows.AuditPolicySubcategory.ps1 b/source/DSCResources/Resources/windows.AuditPolicySubcategory.ps1
similarity index 100%
rename from DSCResources/Resources/windows.AuditPolicySubcategory.ps1
rename to source/DSCResources/Resources/windows.AuditPolicySubcategory.ps1
diff --git a/DSCResources/Resources/windows.AuditSetting.ps1 b/source/DSCResources/Resources/windows.AuditSetting.ps1
similarity index 100%
rename from DSCResources/Resources/windows.AuditSetting.ps1
rename to source/DSCResources/Resources/windows.AuditSetting.ps1
diff --git a/DSCResources/Resources/windows.ProcessMitigation.ps1 b/source/DSCResources/Resources/windows.ProcessMitigation.ps1
similarity index 100%
rename from DSCResources/Resources/windows.ProcessMitigation.ps1
rename to source/DSCResources/Resources/windows.ProcessMitigation.ps1
diff --git a/DSCResources/Resources/windows.RefreshRegistryPolicy.ps1 b/source/DSCResources/Resources/windows.RefreshRegistryPolicy.ps1
similarity index 100%
rename from DSCResources/Resources/windows.RefreshRegistryPolicy.ps1
rename to source/DSCResources/Resources/windows.RefreshRegistryPolicy.ps1
diff --git a/DSCResources/Resources/windows.Registry.ps1 b/source/DSCResources/Resources/windows.Registry.ps1
similarity index 100%
rename from DSCResources/Resources/windows.Registry.ps1
rename to source/DSCResources/Resources/windows.Registry.ps1
diff --git a/DSCResources/Resources/windows.Script.RootHint.ps1 b/source/DSCResources/Resources/windows.Script.RootHint.ps1
similarity index 100%
rename from DSCResources/Resources/windows.Script.RootHint.ps1
rename to source/DSCResources/Resources/windows.Script.RootHint.ps1
diff --git a/DSCResources/Resources/windows.Script.skip.ps1 b/source/DSCResources/Resources/windows.Script.skip.ps1
similarity index 100%
rename from DSCResources/Resources/windows.Script.skip.ps1
rename to source/DSCResources/Resources/windows.Script.skip.ps1
diff --git a/DSCResources/Resources/windows.SecurityOption.ps1 b/source/DSCResources/Resources/windows.SecurityOption.ps1
similarity index 100%
rename from DSCResources/Resources/windows.SecurityOption.ps1
rename to source/DSCResources/Resources/windows.SecurityOption.ps1
diff --git a/DSCResources/Resources/windows.Service.ps1 b/source/DSCResources/Resources/windows.Service.ps1
similarity index 100%
rename from DSCResources/Resources/windows.Service.ps1
rename to source/DSCResources/Resources/windows.Service.ps1
diff --git a/source/DSCResources/Resources/windows.UserRightsAssignment.ps1 b/source/DSCResources/Resources/windows.UserRightsAssignment.ps1
new file mode 100644
index 000000000..bccf6e01d
--- /dev/null
+++ b/source/DSCResources/Resources/windows.UserRightsAssignment.ps1
@@ -0,0 +1,69 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+$rules = $stig.RuleList | Select-Rule -Type UserRightRule
+
+$domainGroupTranslation = @{
+    'Administrators'            = 'Builtin\Administrators'
+    'Auditors'                  = '{0}\auditors'
+    'Authenticated Users'       = 'Authenticated Users'
+    'Domain Admins'             = '{0}\Domain Admins'
+    'Guests'                    = 'Guests'
+    'Local Service'             = 'NT Authority\Local Service'
+    'Network Service'           = 'NT Authority\Network Service'
+    'NT Service\WdiServiceHost' = 'NT Service\WdiServiceHost'
+    'NULL'                      = ''
+    'Security'                  = '{0}\security'
+    'Service'                   = 'Service'
+    'Window Manager\Window Manager Group' = 'Window Manager\Window Manager Group'
+}
+
+$forestGroupTranslation = @{
+    'Enterprise Admins'         = '{0}\Enterprise Admins'
+    'Schema Admins'             = '{0}\Schema Admins'
+}
+
+if ($DomainName -and $ForestName)
+{
+    # This requires a local forest and/or domain name to be injected to ensure a valid account name.
+    $DomainName = PowerStig\Get-DomainName -DomainName $DomainName -Format NetbiosName
+    $ForestName = PowerStig\Get-DomainName -ForestName $ForestName -Format NetbiosName
+
+    foreach ($rule in $rules)
+    {
+        Write-Verbose -Message $rule
+        $identitySplit = $rule.Identity -split ","
+        [System.Collections.ArrayList] $identityList = @()
+
+        foreach ($identity in $identitySplit)
+        {
+            if ($domainGroupTranslation.Contains($identity))
+            {
+                [void] $identityList.Add($domainGroupTranslation.$identity -f $DomainName )
+            }
+            elseif ($forestGroupTranslation.Contains($identity))
+            {
+                [void] $identityList.Add($forestGroupTranslation.$identity -f $ForestName )
+            }
+            # Default to adding the identify as provided for any non-default identities.
+            else
+            {
+                [void] $identityList.Add($identity)
+            }
+        }
+
+        UserRightsAssignment (Get-ResourceTitle -Rule $rule)
+        {
+            Policy   = ($rule.DisplayName -replace " ", "_")
+            Identity = $identityList
+            Force    = [bool] $rule.Force
+        }
+    }
+}
+else
+{
+    foreach ($rule in $rules)
+    {
+        Write-Warning -Message "$($rule.id) not compiled to mof because DomainName and ForestName were not specified"
+    }
+}
diff --git a/DSCResources/Resources/windows.WindowsEventLog.ps1 b/source/DSCResources/Resources/windows.WindowsEventLog.ps1
similarity index 100%
rename from DSCResources/Resources/windows.WindowsEventLog.ps1
rename to source/DSCResources/Resources/windows.WindowsEventLog.ps1
diff --git a/DSCResources/Resources/windows.WindowsFeature.ps1 b/source/DSCResources/Resources/windows.WindowsFeature.ps1
similarity index 100%
rename from DSCResources/Resources/windows.WindowsFeature.ps1
rename to source/DSCResources/Resources/windows.WindowsFeature.ps1
diff --git a/DSCResources/Resources/windows.WindowsOptionalFeature.ps1 b/source/DSCResources/Resources/windows.WindowsOptionalFeature.ps1
similarity index 100%
rename from DSCResources/Resources/windows.WindowsOptionalFeature.ps1
rename to source/DSCResources/Resources/windows.WindowsOptionalFeature.ps1
diff --git a/DSCResources/Resources/windows.xDnsServerSetting.ps1 b/source/DSCResources/Resources/windows.xDnsServerSetting.ps1
similarity index 100%
rename from DSCResources/Resources/windows.xDnsServerSetting.ps1
rename to source/DSCResources/Resources/windows.xDnsServerSetting.ps1
diff --git a/DSCResources/Resources/windows.xIisLogging.ps1 b/source/DSCResources/Resources/windows.xIisLogging.ps1
similarity index 100%
rename from DSCResources/Resources/windows.xIisLogging.ps1
rename to source/DSCResources/Resources/windows.xIisLogging.ps1
diff --git a/DSCResources/Resources/windows.xIisMimeTypeMapping.ps1 b/source/DSCResources/Resources/windows.xIisMimeTypeMapping.ps1
similarity index 100%
rename from DSCResources/Resources/windows.xIisMimeTypeMapping.ps1
rename to source/DSCResources/Resources/windows.xIisMimeTypeMapping.ps1
diff --git a/DSCResources/Resources/windows.xSslSettings.ps1 b/source/DSCResources/Resources/windows.xSslSettings.ps1
similarity index 100%
rename from DSCResources/Resources/windows.xSslSettings.ps1
rename to source/DSCResources/Resources/windows.xSslSettings.ps1
diff --git a/DSCResources/Resources/windows.xWebAppPool.ps1 b/source/DSCResources/Resources/windows.xWebAppPool.ps1
similarity index 100%
rename from DSCResources/Resources/windows.xWebAppPool.ps1
rename to source/DSCResources/Resources/windows.xWebAppPool.ps1
diff --git a/DSCResources/Resources/windows.xWebConfigProperty.ps1 b/source/DSCResources/Resources/windows.xWebConfigProperty.ps1
similarity index 100%
rename from DSCResources/Resources/windows.xWebConfigProperty.ps1
rename to source/DSCResources/Resources/windows.xWebConfigProperty.ps1
diff --git a/DSCResources/Resources/windows.xWebSite.ps1 b/source/DSCResources/Resources/windows.xWebSite.ps1
similarity index 100%
rename from DSCResources/Resources/windows.xWebSite.ps1
rename to source/DSCResources/Resources/windows.xWebSite.ps1
diff --git a/DSCResources/SqlServer/SqlServer.psd1 b/source/DSCResources/SqlServer/SqlServer.psd1
similarity index 100%
rename from DSCResources/SqlServer/SqlServer.psd1
rename to source/DSCResources/SqlServer/SqlServer.psd1
diff --git a/DSCResources/SqlServer/SqlServer.schema.psm1 b/source/DSCResources/SqlServer/SqlServer.schema.psm1
similarity index 100%
rename from DSCResources/SqlServer/SqlServer.schema.psm1
rename to source/DSCResources/SqlServer/SqlServer.schema.psm1
diff --git a/source/DSCResources/Vsphere/Vsphere.psd1 b/source/DSCResources/Vsphere/Vsphere.psd1
new file mode 100644
index 000000000..6ab1c7816
--- /dev/null
+++ b/source/DSCResources/Vsphere/Vsphere.psd1
@@ -0,0 +1,48 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+@{
+
+    # Script module or binary module file associated with this manifest.
+    RootModule = 'Vsphere.schema.psm1'
+
+    # Version number of this module.
+    ModuleVersion = '1.0.0.0'
+
+    # ID used to uniquely identify this module
+    GUID = '4c3bfae0-5bd8-430f-954e-e9ca14356cf5'
+
+    # Author of this module
+    Author = 'Microsoft Corporation'
+
+    # Company or vendor of this module
+    CompanyName = 'Microsoft Corporation'
+
+    # Copyright statement for this module
+    Copyright = '(c) 2020 Microsoft Corporation. All rights reserved.'
+
+    # Description of the functionality provided by this module
+    Description = 'Module for managing the Vsphere DISA STIGs'
+
+    # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
+    FunctionsToExport = @('Vsphere')
+
+    # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
+    CmdletsToExport = @()
+
+    # Variables to export from this module
+    VariablesToExport = '*'
+
+    # Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
+    AliasesToExport = @()
+
+    # Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
+    PrivateData = @{
+
+        PSData = @{
+
+        } # End of PSData hashtable
+
+    } # End of PrivateData
+
+}
diff --git a/source/DSCResources/Vsphere/Vsphere.schema.psm1 b/source/DSCResources/Vsphere/Vsphere.schema.psm1
new file mode 100644
index 000000000..9c1adf6a4
--- /dev/null
+++ b/source/DSCResources/Vsphere/Vsphere.schema.psm1
@@ -0,0 +1,117 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+using module ..\helper.psm1
+using module ..\..\PowerStig.psm1
+
+<#
+    .SYNOPSIS
+        A composite DSC resource to manage Vsphere STIG settings
+    .PARAMETER Version
+        The Vsphere Esxi version for which a DISA STIG configuration is generated, i.e. '6.5'
+    .PARAMETER HostIP
+        The IP address of the Esxi Host that is being targeted
+    .PARAMETER ServerIP
+        The Vcenter Server Ip that the host is connected to. This is required to secure the host with Vsphere resource
+    .PARAMETER Credential
+        The credential to administer the Esxi host
+    .PARAMETER VirtualStandardSwitchGroup
+        A group of standard switches
+    .PARAMETER VmGroup
+        A group of VM's to target on host
+    .PARAMETER StigVersion
+        The version of the Adobe Application STIG to apply and/or monitor
+    .PARAMETER Exception
+        A hashtable of StigId=Value key pairs that are injected into the STIG data and applied to
+        the target node. The title of STIG settings are tagged with the text 'Exception' to identify
+        the exceptions to policy across the data center when you centralize DSC log collection.
+    .PARAMETER OrgSettings
+        The path to the xml file that contains the local organizations preferred settings for STIG
+        items that have allowable ranges.  The OrgSettings parameter also accepts a hashtable for
+        values that need to be modified.  When a hashtable is used, the specified values take
+        presidence over the values defined in the org.default.xml file.
+    .PARAMETER SkipRule
+        The SkipRule Node is injected into the STIG data and applied to the taget node. The title
+        of STIG settings are tagged with the text 'Skip' to identify the skips to policy across the
+        data center when you centralize DSC log collection.
+    .PARAMETER SkipRuleType
+        All STIG rule IDs of the specified type are collected in an array and passed to the Skip-Rule
+        function. Each rule follows the same process as the SkipRule parameter.
+#>
+configuration Vsphere
+{
+    [CmdletBinding()]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]
+        $Version,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]
+        $HostIP,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]
+        $ServerIP,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [System.Management.Automation.PSCredential]
+        $Credential,
+
+        [Parameter()]
+        [string[]]
+        $VirtualStandardSwitchGroup,
+
+        [Parameter()]
+        [string[]]
+        $VmGroup,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [version]
+        $StigVersion,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [hashtable]
+        $Exception,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [object]
+        $OrgSettings,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string[]]
+        $SkipRule,
+
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string[]]
+        $SkipRuleType
+    )
+
+    ##### BEGIN DO NOT MODIFY #####
+    $stig = [STIG]::New('Vsphere', $Version, $StigVersion)
+    $stig.LoadRules($OrgSettings, $Exception, $SkipRule, $SkipRuleType)
+    ##### END DO NOT MODIFY #####
+
+    Import-DscResource -ModuleName Vmware.vSphereDSC -ModuleVersion 2.1.0.58
+    . "$resourcePath\Vsphere.VmHostAcceptanceLevel.ps1"
+    . "$resourcePath\Vsphere.VmHostAdvancedSettings.ps1"
+    . "$resourcePath\Vsphere.VMHostNtpSettings.ps1"
+    . "$resourcePath\Vsphere.VmHostService.ps1"
+    . "$resourcePath\Vsphere.VmHostSNMPAgent.ps1"
+    . "$resourcePath\Vsphere.VmHostVMKernelActiveDumpPartition.ps1"
+    . "$resourcePath\Vsphere.VmHostVssSecurity.ps1"
+    . "$resourcePath\Vsphere.VmHostVssPortGroupSecurity.ps1"
+
+    Import-DscResource -ModuleName PSDscResources -ModuleVersion 2.10.0.0
+    . "$resourcePath\windows.Script.skip.ps1"
+}
diff --git a/DSCResources/WindowsClient/WindowsClient.psd1 b/source/DSCResources/WindowsClient/WindowsClient.psd1
similarity index 100%
rename from DSCResources/WindowsClient/WindowsClient.psd1
rename to source/DSCResources/WindowsClient/WindowsClient.psd1
diff --git a/DSCResources/WindowsClient/WindowsClient.schema.psm1 b/source/DSCResources/WindowsClient/WindowsClient.schema.psm1
similarity index 98%
rename from DSCResources/WindowsClient/WindowsClient.schema.psm1
rename to source/DSCResources/WindowsClient/WindowsClient.schema.psm1
index f9a875af5..ec5ca822f 100644
--- a/DSCResources/WindowsClient/WindowsClient.schema.psm1
+++ b/source/DSCResources/WindowsClient/WindowsClient.schema.psm1
@@ -50,12 +50,10 @@ configuration WindowsClient
         $StigVersion,
 
         [Parameter()]
-        [ValidateNotNullOrEmpty()]
         [string]
         $ForestName,
 
         [Parameter()]
-        [ValidateNotNullOrEmpty()]
         [string]
         $DomainName,
 
diff --git a/DSCResources/WindowsDefender/WindowsDefender.psd1 b/source/DSCResources/WindowsDefender/WindowsDefender.psd1
similarity index 100%
rename from DSCResources/WindowsDefender/WindowsDefender.psd1
rename to source/DSCResources/WindowsDefender/WindowsDefender.psd1
diff --git a/DSCResources/WindowsDefender/WindowsDefender.schema.psm1 b/source/DSCResources/WindowsDefender/WindowsDefender.schema.psm1
similarity index 100%
rename from DSCResources/WindowsDefender/WindowsDefender.schema.psm1
rename to source/DSCResources/WindowsDefender/WindowsDefender.schema.psm1
diff --git a/DSCResources/WindowsDnsServer/WindowsDnsServer.psd1 b/source/DSCResources/WindowsDnsServer/WindowsDnsServer.psd1
similarity index 100%
rename from DSCResources/WindowsDnsServer/WindowsDnsServer.psd1
rename to source/DSCResources/WindowsDnsServer/WindowsDnsServer.psd1
diff --git a/DSCResources/WindowsDnsServer/WindowsDnsServer.schema.psm1 b/source/DSCResources/WindowsDnsServer/WindowsDnsServer.schema.psm1
similarity index 100%
rename from DSCResources/WindowsDnsServer/WindowsDnsServer.schema.psm1
rename to source/DSCResources/WindowsDnsServer/WindowsDnsServer.schema.psm1
diff --git a/DSCResources/WindowsFirewall/WindowsFirewall.psd1 b/source/DSCResources/WindowsFirewall/WindowsFirewall.psd1
similarity index 100%
rename from DSCResources/WindowsFirewall/WindowsFirewall.psd1
rename to source/DSCResources/WindowsFirewall/WindowsFirewall.psd1
diff --git a/DSCResources/WindowsFirewall/WindowsFirewall.schema.psm1 b/source/DSCResources/WindowsFirewall/WindowsFirewall.schema.psm1
similarity index 100%
rename from DSCResources/WindowsFirewall/WindowsFirewall.schema.psm1
rename to source/DSCResources/WindowsFirewall/WindowsFirewall.schema.psm1
diff --git a/DSCResources/WindowsServer/WindowsServer.psd1 b/source/DSCResources/WindowsServer/WindowsServer.psd1
similarity index 100%
rename from DSCResources/WindowsServer/WindowsServer.psd1
rename to source/DSCResources/WindowsServer/WindowsServer.psd1
diff --git a/DSCResources/WindowsServer/WindowsServer.schema.psm1 b/source/DSCResources/WindowsServer/WindowsServer.schema.psm1
similarity index 100%
rename from DSCResources/WindowsServer/WindowsServer.schema.psm1
rename to source/DSCResources/WindowsServer/WindowsServer.schema.psm1
diff --git a/DSCResources/helper.psm1 b/source/DSCResources/helper.psm1
similarity index 100%
rename from DSCResources/helper.psm1
rename to source/DSCResources/helper.psm1
diff --git a/Module/Common/Common.psm1 b/source/Module/Common/Common.psm1
similarity index 100%
rename from Module/Common/Common.psm1
rename to source/Module/Common/Common.psm1
diff --git a/source/Module/Common/Convert/Data.ps1 b/source/Module/Common/Convert/Data.ps1
new file mode 100644
index 000000000..664f08101
--- /dev/null
+++ b/source/Module/Common/Convert/Data.ps1
@@ -0,0 +1,63 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+# This is used to exclude rules from the convert
+data exclusionRuleList
+{
+    ConvertFrom-StringData -StringData @'
+        V-73523 = ''
+        V-6599 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6600 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6601 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6602 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6604 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6611 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6612 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6614 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6615 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6616 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6617 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6618 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6620 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6625 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-6627 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-14657 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-14658 = 'McAfee: Not Applicable to 64-bit systems.'
+        V-14659 = 'McAfee: Not Applicable to 64-bit systems.'
+        V-14660 = 'McAfee: Not Applicable to 64-bit systems.'
+        V-14661 = 'McAfee: Not Applicable to 64-bit systems.'
+        V-42563 = 'McAfee:exclusions have been documented with, and approved by, the ISSO/ISSM/DAA'
+        V-42564 = 'McAfee:exclusions have been documented with, and approved by, the ISSO/ISSM/DAA'
+        V-42565 = 'McAfee:with the assistance of the System Administrator, review each GUID key's szTaskName'
+        V-42566 = 'McAfee:with the assistance of the System Administrator, review each GUID key's szTaskName'
+        V-42567 = 'McAfee:with the assistance of the System Administrator, review each GUID key's szTaskName'
+        V-42572 = 'McAfee:If the ExcludedURLs REG_MULTI_SZ has any entries, and the excluded URLs have not been documented with, and approved by, the ISSO/ISSM/DAA'
+        V-14654 = 'McAfee:The GUID of the weekly on-demand client scan task varies by system'
+        V-94509 = 'Vsphere: To Be added in a future release'
+        V-94025 = 'Vsphere: To Be added in a future release'
+        V-94533 = 'Vsphere: To Be added in a future release'
+        V-77189 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77191 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77195 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77201 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77205 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77209 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77213 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77217 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77221 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77223 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77227 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77231 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77233 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77235 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77239 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77243 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77247 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77249 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77255 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77259 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77263 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77267 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+        V-77269 = 'Set-ProcessMitigation doesn't allow for configuration of Override Settings, this will be updated in next release'
+'@
+}
diff --git a/Module/Common/Convert/Function.Helper.ps1 b/source/Module/Common/Convert/Function.Helper.ps1
similarity index 100%
rename from Module/Common/Convert/Function.Helper.ps1
rename to source/Module/Common/Convert/Function.Helper.ps1
diff --git a/Module/Common/Convert/Function.RangeConversion.ps1 b/source/Module/Common/Convert/Function.RangeConversion.ps1
similarity index 99%
rename from Module/Common/Convert/Function.RangeConversion.ps1
rename to source/Module/Common/Convert/Function.RangeConversion.ps1
index 18504ad20..8f4999a69 100644
--- a/Module/Common/Convert/Function.RangeConversion.ps1
+++ b/source/Module/Common/Convert/Function.RangeConversion.ps1
@@ -385,7 +385,7 @@ function ConvertTo-OrTestString
     {
         $tokens = [System.Management.Automation.PSParser]::Tokenize($string, [ref]$null)
         $orgSettings = $tokens.Where( {$PSItem.type -eq 'Number' -and $PSItem.Content -notmatch '\dx\d{8}' }).Content
-        if($string -match 'or if the Value Name does not exist')
+        if ($string -match 'or if the Value Name does not exist')
         {
             $orgSettings += 'ShouldBeAbsent'
         }
diff --git a/Module/Common/Function.Xccdf.ps1 b/source/Module/Common/Function.Xccdf.ps1
similarity index 100%
rename from Module/Common/Function.Xccdf.ps1
rename to source/Module/Common/Function.Xccdf.ps1
diff --git a/Module/Common/Functions.Helper.ps1 b/source/Module/Common/Functions.Helper.ps1
similarity index 100%
rename from Module/Common/Functions.Helper.ps1
rename to source/Module/Common/Functions.Helper.ps1
diff --git a/Module/Common/Functions.XccdfXml.ps1 b/source/Module/Common/Functions.XccdfXml.ps1
similarity index 93%
rename from Module/Common/Functions.XccdfXml.ps1
rename to source/Module/Common/Functions.XccdfXml.ps1
index 11837d893..2465eddd5 100644
--- a/Module/Common/Functions.XccdfXml.ps1
+++ b/source/Module/Common/Functions.XccdfXml.ps1
@@ -215,7 +215,7 @@ function Get-StigRuleList
                         So we simply unwind the changes we made earlier so that any
                         new text we added is removed by reversing the regex match.
                     #>
-    
+
                     # Trim the unique char from split rules if they exist
                     foreach ($correction in $StigGroupListChangeLog[($rule.Id -split '\.')[0]])
                     {
@@ -365,7 +365,8 @@ function Split-BenchmarkId
         'Outlook',
         'PowerPoint',
         'Word',
-        'System'
+        'System',
+        'Visio'
     )
 
     $id = $id -replace ($idVariations -join '|'), ''
@@ -374,13 +375,10 @@ function Split-BenchmarkId
     {
         {$PSItem -match "SQL_Server"}
         {
-            # The metadata does not differentiate between the database and instance STIG so we have to get that from the file name.
-            $sqlRole = Get-SqlTechnologyRole -Path $FilePath
-            $returnId = $id -replace ($sqlServerVariations -join '|'), 'SqlServer'
-
-            # SQL 2012 Instance 1.17 has a different format which requires this line, can be removed when this STIG is no longer in archive
-            $returnId = $returnId -replace "_Database_Instance" + ""
-            $returnId = '{0}_{1}' -f $returnId, $sqlRole
+            $sqlRole = Get-SqlTechnologyRole -Path $FilePath -Id $id
+            $id -match "(?<Version>\d{4})"
+            $sqlVersion = $Matches['Version']
+            $returnId = 'SqlServer_{0}_{1}' -f $sqlVersion, $sqlRole
             continue
         }
         {$PSItem -match "_Firewall"}
@@ -403,6 +401,16 @@ function Split-BenchmarkId
             $returnId = 'IISSite_8.5'
             continue
         }
+        {$PSItem -match "IIS_10-0_Site"}
+        {
+            $returnId = 'IISSite_10.0'
+            continue
+        }
+        {$PSItem -match "IIS_10-0_Server"}
+        {
+            $returnId = 'IISServer_10.0'
+            continue
+        }
         {$PSItem -match "Domain_Name_System"}
         {
             # The Windows Server 2012 and 2012 R2 STIGs are combined, so return the 2012R2
@@ -444,11 +452,11 @@ function Split-BenchmarkId
             $returnId = "FireFox_All"
             continue
         }
-        {$PSItem -match 'Excel|Outlook|PowerPoint|Word|System'}
+        {$PSItem -match 'Excel|Outlook|PowerPoint|Word|System|Visio'}
         {
             $officeStig = ($id -split '_')
 
-            if($PSItem -match 'System')
+            if ($PSItem -match 'System')
             {
                 $officeStig = $officeStig[2], $officeStig[3] -join ""
                 $returnId = '{0}_{1}' -f 'Office', $officeStig
@@ -476,6 +484,11 @@ function Split-BenchmarkId
             $returnId = 'McAfee_8.8_VirusScan'
             continue
         }
+        {$PSItem -match 'Vmware_Vsphere'}
+        {
+            $returnId = 'Vsphere_6.5'
+            continue
+        }
         default
         {
             $returnId = $id
@@ -501,6 +514,10 @@ function Get-SqlTechnologyRole
     [OutputType([string])]
     param
     (
+        [Parameter(Mandatory = $true)]
+        [string]
+        $Id,
+
         [Parameter(Mandatory=$true)]
         [AllowEmptyString()]
         [string]
@@ -510,6 +527,11 @@ function Get-SqlTechnologyRole
     $split = $Path -split '_'
     $stigIndex = $split.IndexOf('STIG')
     $sqlRole = $split[$stigIndex -1]
+    if ($sqlRole -match '\w\d{1,}\w\d{1,}')
+    {
+        $null = $Id -match "(?<Type>Database|Instance)"
+        $sqlRole = $Matches['Type']
+    }
 
     return $sqlRole
 }
@@ -537,12 +559,8 @@ function Get-StigVersionNumber
     )
 
     # Extract the revision number from the xccdf
-    $revision = ( $StigDetails.Benchmark.'plain-text'.'#text' `
-            -split "(Release:)(.*?)(Benchmark)" )[2].trim()
-
+    $revision = ($StigDetails.Benchmark.'plain-text'.'#text' -split "(Release:)(.*?)(Benchmark)")[2].trim()
     "$($StigDetails.Benchmark.version).$revision"
-
 }
 
 #endregion
-
diff --git a/Module/Rule.AccountPolicy/AccountPolicyRule.psm1 b/source/Module/Rule.AccountPolicy/AccountPolicyRule.psm1
similarity index 92%
rename from Module/Rule.AccountPolicy/AccountPolicyRule.psm1
rename to source/Module/Rule.AccountPolicy/AccountPolicyRule.psm1
index 7fd66f2be..b42faa77e 100644
--- a/Module/Rule.AccountPolicy/AccountPolicyRule.psm1
+++ b/source/Module/Rule.AccountPolicy/AccountPolicyRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER PolicyValue
         The value the account policy should be set to.
 #>
-Class AccountPolicyRule : Rule
+class AccountPolicyRule : Rule
 {
     [string] $PolicyName
     [string] $PolicyValue <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class AccountPolicyRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    AccountPolicyRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    AccountPolicyRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class AccountPolicyRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    AccountPolicyRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    AccountPolicyRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.AccountPolicy/Convert/AccountPolicyRule.Convert.psm1 b/source/Module/Rule.AccountPolicy/Convert/AccountPolicyRule.Convert.psm1
similarity index 97%
rename from Module/Rule.AccountPolicy/Convert/AccountPolicyRule.Convert.psm1
rename to source/Module/Rule.AccountPolicy/Convert/AccountPolicyRule.Convert.psm1
index 8dc890acd..660c93551 100644
--- a/Module/Rule.AccountPolicy/Convert/AccountPolicyRule.Convert.psm1
+++ b/source/Module/Rule.AccountPolicy/Convert/AccountPolicyRule.Convert.psm1
@@ -14,7 +14,7 @@ using namespace System.Text
         Account Policy rule. The configuration details are then extracted and
         validated before returning the object.
 #>
-Class AccountPolicyRuleConvert : AccountPolicyRule
+class AccountPolicyRuleConvert : AccountPolicyRule
 {
     <#
         .SYNOPSIS
@@ -30,7 +30,7 @@ Class AccountPolicyRuleConvert : AccountPolicyRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    AccountPolicyRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    AccountPolicyRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         [RegularExpressions.MatchCollection] $tokens = $this.ExtractProperties()
         $this.SetPolicyName($tokens)
@@ -106,7 +106,7 @@ Class AccountPolicyRuleConvert : AccountPolicyRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'AccountPolicy'
         }
diff --git a/Module/Rule.AuditPolicy/AuditPolicyRule.psm1 b/source/Module/Rule.AuditPolicy/AuditPolicyRule.psm1
similarity index 93%
rename from Module/Rule.AuditPolicy/AuditPolicyRule.psm1
rename to source/Module/Rule.AuditPolicy/AuditPolicyRule.psm1
index d2f81e00d..0618c7af6 100644
--- a/Module/Rule.AuditPolicy/AuditPolicyRule.psm1
+++ b/source/Module/Rule.AuditPolicy/AuditPolicyRule.psm1
@@ -16,7 +16,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Ensure
         A present or absent flag
 #>
-Class AuditPolicyRule : Rule
+class AuditPolicyRule : Rule
 {
     [string] $Subcategory
     [string] $AuditFlag
@@ -36,7 +36,7 @@ Class AuditPolicyRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    AuditPolicyRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    AuditPolicyRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -48,7 +48,7 @@ Class AuditPolicyRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    AuditPolicyRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    AuditPolicyRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.AuditPolicy/Convert/AuditPolicyRule.Convert.psm1 b/source/Module/Rule.AuditPolicy/Convert/AuditPolicyRule.Convert.psm1
similarity index 91%
rename from Module/Rule.AuditPolicy/Convert/AuditPolicyRule.Convert.psm1
rename to source/Module/Rule.AuditPolicy/Convert/AuditPolicyRule.Convert.psm1
index b1be48503..05579cfad 100644
--- a/Module/Rule.AuditPolicy/Convert/AuditPolicyRule.Convert.psm1
+++ b/source/Module/Rule.AuditPolicy/Convert/AuditPolicyRule.Convert.psm1
@@ -9,7 +9,7 @@ using namespace System.Text
     .SYNOPSIS
         Converts the xccdf check-content element into an audit policy object.
 #>
-Class AuditPolicyRuleConvert : AuditPolicyRule
+class AuditPolicyRuleConvert : AuditPolicyRule
 {
     <#
         .SYNOPSIS
@@ -25,7 +25,7 @@ Class AuditPolicyRuleConvert : AuditPolicyRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    AuditPolicyRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    AuditPolicyRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $tokens = $this.ExtractProperties()
         $this.SetSubcategory($tokens)
@@ -50,7 +50,7 @@ Class AuditPolicyRuleConvert : AuditPolicyRule
     {
         return [regex]::Matches(
             $this.RawString,
-            '(?:(?:\w+(?:\s|\/))+(?:(?:>|-)>(?:\s+)?))(?<subcategory>(?:\w+\s)+)(?:-(?:\s+)?)(?<auditflag>(?:\w+)+)'
+            '(?:(?:\w+(?:\s|\/))+(?:(?: >|>|-)>(?:\s+)?))(?<subcategory>(?:.+?(?=\s-\s)))\s-\s(?<auditflag>(?:\w+)+)'
         )
     }
 
@@ -94,7 +94,7 @@ Class AuditPolicyRuleConvert : AuditPolicyRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'AuditPolicySubcategory'
         }
diff --git a/Module/Rule.AuditSetting/AuditSettingRule.psm1 b/source/Module/Rule.AuditSetting/AuditSettingRule.psm1
similarity index 92%
rename from Module/Rule.AuditSetting/AuditSettingRule.psm1
rename to source/Module/Rule.AuditSetting/AuditSettingRule.psm1
index ecfdcd8c3..139a1fdc7 100644
--- a/Module/Rule.AuditSetting/AuditSettingRule.psm1
+++ b/source/Module/Rule.AuditSetting/AuditSettingRule.psm1
@@ -19,7 +19,7 @@ using module .\..\Rule\Rule.psm1
         The PowerShell equivalent operator
 
 #>
-Class AuditSettingRule : Rule
+class AuditSettingRule : Rule
 {
     [string] $Query
     [string] $Property
@@ -40,7 +40,7 @@ Class AuditSettingRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    AuditSettingRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    AuditSettingRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -52,7 +52,7 @@ Class AuditSettingRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    AuditSettingRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    AuditSettingRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.AuditSetting/Convert/AuditSettingRule.Convert.psm1 b/source/Module/Rule.AuditSetting/Convert/AuditSettingRule.Convert.psm1
similarity index 93%
rename from Module/Rule.AuditSetting/Convert/AuditSettingRule.Convert.psm1
rename to source/Module/Rule.AuditSetting/Convert/AuditSettingRule.Convert.psm1
index ec6afa703..f3d03a219 100644
--- a/Module/Rule.AuditSetting/Convert/AuditSettingRule.Convert.psm1
+++ b/source/Module/Rule.AuditSetting/Convert/AuditSettingRule.Convert.psm1
@@ -22,7 +22,7 @@ foreach ($supportFile in $supportFileList)
         class for parsing and validation.
 
 #>
-Class AuditSettingRuleConvert : AuditSettingRule
+class AuditSettingRuleConvert : AuditSettingRule
 {
     <#
         .SYNOPSIS
@@ -38,9 +38,9 @@ Class AuditSettingRuleConvert : AuditSettingRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    AuditSettingRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    AuditSettingRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
-        Switch ($this.rawString)
+        switch ($this.rawString)
         {
             {$PSItem -Match "winver\.exe" }
             {
@@ -79,7 +79,7 @@ Class AuditSettingRuleConvert : AuditSettingRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'AuditSetting'
         }
diff --git a/Module/Rule.DnsServerRootHint/Convert/DnsServerRootHintRule.Convert.psm1 b/source/Module/Rule.DnsServerRootHint/Convert/DnsServerRootHintRule.Convert.psm1
similarity index 94%
rename from Module/Rule.DnsServerRootHint/Convert/DnsServerRootHintRule.Convert.psm1
rename to source/Module/Rule.DnsServerRootHint/Convert/DnsServerRootHintRule.Convert.psm1
index 79ec5ccb8..f788d4d30 100644
--- a/Module/Rule.DnsServerRootHint/Convert/DnsServerRootHintRule.Convert.psm1
+++ b/source/Module/Rule.DnsServerRootHint/Convert/DnsServerRootHintRule.Convert.psm1
@@ -26,7 +26,7 @@ foreach ($supportFile in $supportFileList)
     .PARAMETER IpAddress
         The ip address of the root hint server
 #>
-Class DnsServerRootHintRuleConvert : DnsServerRootHintRule
+class DnsServerRootHintRuleConvert : DnsServerRootHintRule
 {
     <#
         .SYNOPSIS
@@ -42,7 +42,7 @@ Class DnsServerRootHintRuleConvert : DnsServerRootHintRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    DnsServerRootHintRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    DnsServerRootHintRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.set_HostName('$null')
         $this.set_IpAddress('$null')
@@ -52,7 +52,7 @@ Class DnsServerRootHintRuleConvert : DnsServerRootHintRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'Script'
         }
diff --git a/Module/Rule.DnsServerRootHint/DnsServerRootHintRule.psm1 b/source/Module/Rule.DnsServerRootHint/DnsServerRootHintRule.psm1
similarity index 90%
rename from Module/Rule.DnsServerRootHint/DnsServerRootHintRule.psm1
rename to source/Module/Rule.DnsServerRootHint/DnsServerRootHintRule.psm1
index da85a7a41..c8638a9e7 100644
--- a/Module/Rule.DnsServerRootHint/DnsServerRootHintRule.psm1
+++ b/source/Module/Rule.DnsServerRootHint/DnsServerRootHintRule.psm1
@@ -11,7 +11,7 @@ using module .\..\Rule\Rule.psm1
         The DnsServerRootHintRule class is used to maange the Account Policy Settings.
 
 #>
-Class DnsServerRootHintRule : Rule
+class DnsServerRootHintRule : Rule
 {
     [string] $HostName
     [string] $IpAddress <#(ExceptionValue)#>
@@ -30,7 +30,7 @@ Class DnsServerRootHintRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    DnsServerRootHintRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    DnsServerRootHintRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -42,7 +42,7 @@ Class DnsServerRootHintRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    DnsServerRootHintRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    DnsServerRootHintRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.DnsServerSetting/Convert/Data.ps1 b/source/Module/Rule.DnsServerSetting/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.DnsServerSetting/Convert/Data.ps1
rename to source/Module/Rule.DnsServerSetting/Convert/Data.ps1
diff --git a/Module/Rule.DnsServerSetting/Convert/DnsServerSettingRule.Convert.psm1 b/source/Module/Rule.DnsServerSetting/Convert/DnsServerSettingRule.Convert.psm1
similarity index 96%
rename from Module/Rule.DnsServerSetting/Convert/DnsServerSettingRule.Convert.psm1
rename to source/Module/Rule.DnsServerSetting/Convert/DnsServerSettingRule.Convert.psm1
index a59ee1a06..c9555a998 100644
--- a/Module/Rule.DnsServerSetting/Convert/DnsServerSettingRule.Convert.psm1
+++ b/source/Module/Rule.DnsServerSetting/Convert/DnsServerSettingRule.Convert.psm1
@@ -23,7 +23,7 @@ foreach ($supportFile in $supportFileList)
         parsing and validation.
 
 #>
-Class DnsServerSettingRuleConvert : DnsServerSettingRule
+class DnsServerSettingRuleConvert : DnsServerSettingRule
 {
     <#
         .SYNOPSIS
@@ -39,7 +39,7 @@ Class DnsServerSettingRuleConvert : DnsServerSettingRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    DnsServerSettingRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    DnsServerSettingRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetDnsServerPropertyName()
         $this.SetDnsServerPropertyValue()
@@ -95,7 +95,7 @@ Class DnsServerSettingRuleConvert : DnsServerSettingRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'xDnsServerSetting'
         }
diff --git a/Module/Rule.DnsServerSetting/Convert/Methods.ps1 b/source/Module/Rule.DnsServerSetting/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.DnsServerSetting/Convert/Methods.ps1
rename to source/Module/Rule.DnsServerSetting/Convert/Methods.ps1
diff --git a/Module/Rule.DnsServerSetting/DnsServerSettingRule.psm1 b/source/Module/Rule.DnsServerSetting/DnsServerSettingRule.psm1
similarity index 91%
rename from Module/Rule.DnsServerSetting/DnsServerSettingRule.psm1
rename to source/Module/Rule.DnsServerSetting/DnsServerSettingRule.psm1
index 0d559b58b..45e3e7125 100644
--- a/Module/Rule.DnsServerSetting/DnsServerSettingRule.psm1
+++ b/source/Module/Rule.DnsServerSetting/DnsServerSettingRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER PropertyValue
         The value to set the proerty to
 #>
-Class DnsServerSettingRule : Rule
+class DnsServerSettingRule : Rule
 {
     [string] $PropertyName
     [string] $PropertyValue <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class DnsServerSettingRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    DnsServerSettingRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    DnsServerSettingRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class DnsServerSettingRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    DnsServerSettingRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    DnsServerSettingRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.Document/Convert/DocumentRule.Convert.psm1 b/source/Module/Rule.Document/Convert/DocumentRule.Convert.psm1
similarity index 95%
rename from Module/Rule.Document/Convert/DocumentRule.Convert.psm1
rename to source/Module/Rule.Document/Convert/DocumentRule.Convert.psm1
index 771308d2e..b30c15c48 100644
--- a/Module/Rule.Document/Convert/DocumentRule.Convert.psm1
+++ b/source/Module/Rule.Document/Convert/DocumentRule.Convert.psm1
@@ -21,7 +21,7 @@ foreach ($supportFile in $supportFileList)
         document rule, it is passed to the DocumentRuleConvert class for parsing
         and validation.
 #>
-Class DocumentRuleConvert : DocumentRule
+class DocumentRuleConvert : DocumentRule
 {
     <#
         .SYNOPSIS
@@ -37,7 +37,7 @@ Class DocumentRuleConvert : DocumentRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    DocumentRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    DocumentRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.DscResource = 'None'
     }
diff --git a/Module/Rule.Document/DocumentRule.psm1 b/source/Module/Rule.Document/DocumentRule.psm1
similarity index 92%
rename from Module/Rule.Document/DocumentRule.psm1
rename to source/Module/Rule.Document/DocumentRule.psm1
index 0ee02ffe5..003a1b155 100644
--- a/Module/Rule.Document/DocumentRule.psm1
+++ b/source/Module/Rule.Document/DocumentRule.psm1
@@ -11,7 +11,7 @@ using module .\..\Rule\Rule.psm1
         The DocumentRule class is used to maange the Document Settings.
 
 #>
-Class DocumentRule : Rule
+class DocumentRule : Rule
 {
     <#
         .SYNOPSIS
@@ -50,7 +50,7 @@ Class DocumentRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    DocumentRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    DocumentRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -62,7 +62,7 @@ Class DocumentRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    DocumentRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    DocumentRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.FileContent/Convert/Data.ps1 b/source/Module/Rule.FileContent/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.FileContent/Convert/Data.ps1
rename to source/Module/Rule.FileContent/Convert/Data.ps1
diff --git a/Module/Rule.FileContent/Convert/FileContentRule.Convert.psm1 b/source/Module/Rule.FileContent/Convert/FileContentRule.Convert.psm1
similarity index 97%
rename from Module/Rule.FileContent/Convert/FileContentRule.Convert.psm1
rename to source/Module/Rule.FileContent/Convert/FileContentRule.Convert.psm1
index d4e7ed17e..d1b6ec430 100644
--- a/Module/Rule.FileContent/Convert/FileContentRule.Convert.psm1
+++ b/source/Module/Rule.FileContent/Convert/FileContentRule.Convert.psm1
@@ -20,7 +20,7 @@ foreach ($supportFile in $supportFileList)
         The FileContentRule class is used to manage STIGs for applications that utilize a
         configuration file to manage security settings
 #>
-Class FileContentRuleConvert : FileContentRule
+class FileContentRuleConvert : FileContentRule
 {
     <#
         .SYNOPSIS
@@ -36,7 +36,7 @@ Class FileContentRuleConvert : FileContentRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    FileContentRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    FileContentRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetKeyName()
         $this.SetValue()
@@ -87,7 +87,7 @@ Class FileContentRuleConvert : FileContentRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             if ($this.Key -match 'deployment.')
             {
diff --git a/Module/Rule.FileContent/Convert/FileContentType/FileContentType.psm1 b/source/Module/Rule.FileContent/Convert/FileContentType/FileContentType.psm1
similarity index 98%
rename from Module/Rule.FileContent/Convert/FileContentType/FileContentType.psm1
rename to source/Module/Rule.FileContent/Convert/FileContentType/FileContentType.psm1
index 457a560f7..bf49fcdda 100644
--- a/Module/Rule.FileContent/Convert/FileContentType/FileContentType.psm1
+++ b/source/Module/Rule.FileContent/Convert/FileContentType/FileContentType.psm1
@@ -11,7 +11,7 @@
     .PARAMETER Instance
         Maintains a single instance of the class object
 #>
-Class FileContentType
+class FileContentType
 {
     static [FileContentType] $Instance
     #region Constructor
diff --git a/Module/Rule.FileContent/Convert/FileContentType/Methods.MozillaFirefox.ps1 b/source/Module/Rule.FileContent/Convert/FileContentType/Methods.MozillaFirefox.ps1
similarity index 100%
rename from Module/Rule.FileContent/Convert/FileContentType/Methods.MozillaFirefox.ps1
rename to source/Module/Rule.FileContent/Convert/FileContentType/Methods.MozillaFirefox.ps1
diff --git a/Module/Rule.FileContent/Convert/FileContentType/Methods.OracleJRE.ps1 b/source/Module/Rule.FileContent/Convert/FileContentType/Methods.OracleJRE.ps1
similarity index 100%
rename from Module/Rule.FileContent/Convert/FileContentType/Methods.OracleJRE.ps1
rename to source/Module/Rule.FileContent/Convert/FileContentType/Methods.OracleJRE.ps1
diff --git a/Module/Rule.FileContent/Convert/Methods.ps1 b/source/Module/Rule.FileContent/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.FileContent/Convert/Methods.ps1
rename to source/Module/Rule.FileContent/Convert/Methods.ps1
diff --git a/Module/Rule.FileContent/FileContentRule.psm1 b/source/Module/Rule.FileContent/FileContentRule.psm1
similarity index 92%
rename from Module/Rule.FileContent/FileContentRule.psm1
rename to source/Module/Rule.FileContent/FileContentRule.psm1
index c72da50ad..41a0837cb 100644
--- a/Module/Rule.FileContent/FileContentRule.psm1
+++ b/source/Module/Rule.FileContent/FileContentRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Value
         Specifies the value of the configuration setting
 #>
-Class FileContentRule : Rule
+class FileContentRule : Rule
 {
     [string] $Key
     [string] $Value <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class FileContentRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    FileContentRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    FileContentRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class FileContentRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    FileContentRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    FileContentRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.Group/Convert/GroupRule.Convert.psm1 b/source/Module/Rule.Group/Convert/GroupRule.Convert.psm1
similarity index 95%
rename from Module/Rule.Group/Convert/GroupRule.Convert.psm1
rename to source/Module/Rule.Group/Convert/GroupRule.Convert.psm1
index 7891748a8..270cde3b8 100644
--- a/Module/Rule.Group/Convert/GroupRule.Convert.psm1
+++ b/source/Module/Rule.Group/Convert/GroupRule.Convert.psm1
@@ -21,7 +21,7 @@ foreach ($supportFile in $supportFileList)
         group rule, it is passed to the GroupRuleConvert class for parsing
         and validation.
 #>
-Class GroupRuleConvert : GroupRule
+class GroupRuleConvert : GroupRule
 {
     <#
         .SYNOPSIS
@@ -37,7 +37,7 @@ Class GroupRuleConvert : GroupRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    GroupRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    GroupRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetGroupName()
         $this.SetMembersToExclude()
@@ -96,7 +96,7 @@ Class GroupRuleConvert : GroupRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'Group'
         }
diff --git a/Module/Rule.Group/Convert/Methods.ps1 b/source/Module/Rule.Group/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.Group/Convert/Methods.ps1
rename to source/Module/Rule.Group/Convert/Methods.ps1
diff --git a/Module/Rule.Group/Convert/Template.GroupDetail.txt b/source/Module/Rule.Group/Convert/Template.GroupDetail.txt
similarity index 100%
rename from Module/Rule.Group/Convert/Template.GroupDetail.txt
rename to source/Module/Rule.Group/Convert/Template.GroupDetail.txt
diff --git a/Module/Rule.Group/GroupRule.psm1 b/source/Module/Rule.Group/GroupRule.psm1
similarity index 90%
rename from Module/Rule.Group/GroupRule.psm1
rename to source/Module/Rule.Group/GroupRule.psm1
index 78bcffca8..562f3fac1 100644
--- a/Module/Rule.Group/GroupRule.psm1
+++ b/source/Module/Rule.Group/GroupRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER MembersToExclude
         The list of memmbers that are not allowed to be in the group
 #>
-Class GroupRule : Rule
+class GroupRule : Rule
 {
     [string] $GroupName
     [string[]] $MembersToExclude <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class GroupRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    GroupRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    GroupRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class GroupRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    GroupRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    GroupRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1 b/source/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1
similarity index 99%
rename from Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1
rename to source/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1
index df6f33f02..2021fd9c7 100644
--- a/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1
+++ b/source/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1
@@ -36,7 +36,7 @@ using module .\..\..\Rule.WindowsFeature\Convert\WindowsFeatureRule.Convert.psm1
         a predefined rule type. The configuration details are then extracted
         and validated before returning the object.
 #>
-Class HardCodedRuleConvert
+class HardCodedRuleConvert
 {
     [System.Object] $Rule
     <#
diff --git a/Module/Rule.IISLogging/Convert/Data.ps1 b/source/Module/Rule.IISLogging/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.IISLogging/Convert/Data.ps1
rename to source/Module/Rule.IISLogging/Convert/Data.ps1
diff --git a/Module/Rule.IISLogging/Convert/IISLoggingRule.Convert.psm1 b/source/Module/Rule.IISLogging/Convert/IISLoggingRule.Convert.psm1
similarity index 96%
rename from Module/Rule.IISLogging/Convert/IISLoggingRule.Convert.psm1
rename to source/Module/Rule.IISLogging/Convert/IISLoggingRule.Convert.psm1
index 3d5cea609..3e8f5ecbf 100644
--- a/Module/Rule.IISLogging/Convert/IISLoggingRule.Convert.psm1
+++ b/source/Module/Rule.IISLogging/Convert/IISLoggingRule.Convert.psm1
@@ -23,7 +23,7 @@ foreach ($supportFile in $supportFileList)
         IIS Log rule, it is passed to the IisLoggingRuleConvert class for parsing
         and validation.
 #>
-Class IisLoggingRuleConvert : IisLoggingRule
+class IisLoggingRuleConvert : IisLoggingRule
 {
     <#
         .SYNOPSIS
@@ -39,9 +39,8 @@ Class IisLoggingRuleConvert : IisLoggingRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    IisLoggingRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    IisLoggingRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
-
         if ($this.conversionstatus -eq 'pass')
         {
             $this.SetDuplicateRule()
@@ -174,7 +173,7 @@ Class IisLoggingRuleConvert : IisLoggingRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             if ($global:stigTitle -match "Server")
             {
@@ -196,7 +195,7 @@ Class IisLoggingRuleConvert : IisLoggingRule
         if
         (
             $CheckContent -Match 'Logging' -and
-            $CheckContent -Match 'IIS 8\.5' -and
+            $CheckContent -Match 'IIS 8\.5|IIS 10\.0' -and
             $CheckContent -NotMatch 'review source IP' -and
             $CheckContent -NotMatch 'verify only authorized groups' -and
             $CheckContent -NotMatch 'Confirm|Consult with the System Administrator' -and
diff --git a/Module/Rule.IISLogging/Convert/Methods.ps1 b/source/Module/Rule.IISLogging/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.IISLogging/Convert/Methods.ps1
rename to source/Module/Rule.IISLogging/Convert/Methods.ps1
diff --git a/Module/Rule.IISLogging/IISLoggingRule.psm1 b/source/Module/Rule.IISLogging/IISLoggingRule.psm1
similarity index 92%
rename from Module/Rule.IISLogging/IISLoggingRule.psm1
rename to source/Module/Rule.IISLogging/IISLoggingRule.psm1
index c67222d1d..33b8fc6e9 100644
--- a/Module/Rule.IISLogging/IISLoggingRule.psm1
+++ b/source/Module/Rule.IISLogging/IISLoggingRule.psm1
@@ -19,7 +19,7 @@ using module .\..\Rule\Rule.psm1
 
     .PARAMETER LogTargetW3C
 #>
-Class IisLoggingRule : Rule
+class IisLoggingRule : Rule
 {
     [object[]] $LogCustomFieldEntry
     [string] $LogFlags
@@ -41,7 +41,7 @@ Class IisLoggingRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    IisLoggingRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    IisLoggingRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -53,7 +53,7 @@ Class IisLoggingRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    IisLoggingRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    IisLoggingRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.Manual/Convert/ManualRule.Convert.psm1 b/source/Module/Rule.Manual/Convert/ManualRule.Convert.psm1
similarity index 91%
rename from Module/Rule.Manual/Convert/ManualRule.Convert.psm1
rename to source/Module/Rule.Manual/Convert/ManualRule.Convert.psm1
index 7a803e249..d16c811e0 100644
--- a/Module/Rule.Manual/Convert/ManualRule.Convert.psm1
+++ b/source/Module/Rule.Manual/Convert/ManualRule.Convert.psm1
@@ -20,7 +20,7 @@ foreach ($supportFile in $supportFileList)
         check-content of the xccdf. Once a STIG rule is identifed as a manual
         rule, it is passed to the ManualRule class for parsing and validation.
 #>
-Class ManualRuleConvert : ManualRule
+class ManualRuleConvert : ManualRule
 {
     <#
         .SYNOPSIS
@@ -36,7 +36,7 @@ Class ManualRuleConvert : ManualRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    ManualRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    ManualRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.DscResource = 'None'
     }
diff --git a/Module/Rule.Manual/ManualRule.psm1 b/source/Module/Rule.Manual/ManualRule.psm1
similarity index 88%
rename from Module/Rule.Manual/ManualRule.psm1
rename to source/Module/Rule.Manual/ManualRule.psm1
index 18463bb91..77c48db88 100644
--- a/Module/Rule.Manual/ManualRule.psm1
+++ b/source/Module/Rule.Manual/ManualRule.psm1
@@ -11,7 +11,7 @@ using module .\..\Rule\Rule.psm1
         The ManualRule class is used to maange the Account Policy Settings.
 
 #>
-Class ManualRule : Rule
+class ManualRule : Rule
 {
     <#(ExceptionValue)#>
 
@@ -29,7 +29,7 @@ Class ManualRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    ManualRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    ManualRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -41,7 +41,7 @@ Class ManualRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    ManualRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    ManualRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.MimeType/Convert/Data.ps1 b/source/Module/Rule.MimeType/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.MimeType/Convert/Data.ps1
rename to source/Module/Rule.MimeType/Convert/Data.ps1
diff --git a/Module/Rule.MimeType/Convert/Methods.ps1 b/source/Module/Rule.MimeType/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.MimeType/Convert/Methods.ps1
rename to source/Module/Rule.MimeType/Convert/Methods.ps1
diff --git a/Module/Rule.MimeType/Convert/MimeTypeRule.Convert.psm1 b/source/Module/Rule.MimeType/Convert/MimeTypeRule.Convert.psm1
similarity index 95%
rename from Module/Rule.MimeType/Convert/MimeTypeRule.Convert.psm1
rename to source/Module/Rule.MimeType/Convert/MimeTypeRule.Convert.psm1
index d21f9940a..2131593e1 100644
--- a/Module/Rule.MimeType/Convert/MimeTypeRule.Convert.psm1
+++ b/source/Module/Rule.MimeType/Convert/MimeTypeRule.Convert.psm1
@@ -22,7 +22,7 @@ foreach ($supportFile in $supportFileList)
         and validation.
 
 #>
-Class MimeTypeRuleConvert : MimeTypeRule
+class MimeTypeRuleConvert : MimeTypeRule
 {
     <#
         .SYNOPSIS
@@ -38,7 +38,7 @@ Class MimeTypeRuleConvert : MimeTypeRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    MimeTypeRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    MimeTypeRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetExtension()
         $this.SetMimeType()
@@ -139,7 +139,7 @@ Class MimeTypeRuleConvert : MimeTypeRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'xIisMimeTypeMapping'
         }
@@ -154,7 +154,7 @@ Class MimeTypeRuleConvert : MimeTypeRule
         if
         (
             $CheckContent -Match 'MIME Types' -and
-            $CheckContent -Match 'IIS 8\.5'
+            $CheckContent -Match 'IIS 8\.5|IIS 10\.0'
         )
         {
             return $true
diff --git a/Module/Rule.MimeType/MimeTypeRule.psm1 b/source/Module/Rule.MimeType/MimeTypeRule.psm1
similarity index 90%
rename from Module/Rule.MimeType/MimeTypeRule.psm1
rename to source/Module/Rule.MimeType/MimeTypeRule.psm1
index 8c65a615e..3d7c35be4 100644
--- a/Module/Rule.MimeType/MimeTypeRule.psm1
+++ b/source/Module/Rule.MimeType/MimeTypeRule.psm1
@@ -16,7 +16,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Ensure
         A present or absent flag
 #>
-Class MimeTypeRule : Rule
+class MimeTypeRule : Rule
 {
     [string] $Extension
     [string] $MimeType
@@ -36,7 +36,7 @@ Class MimeTypeRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    MimeTypeRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    MimeTypeRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -48,7 +48,7 @@ Class MimeTypeRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    MimeTypeRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    MimeTypeRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.Permission/Convert/Data.ps1 b/source/Module/Rule.Permission/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.Permission/Convert/Data.ps1
rename to source/Module/Rule.Permission/Convert/Data.ps1
diff --git a/Module/Rule.Permission/Convert/Methods.ps1 b/source/Module/Rule.Permission/Convert/Methods.ps1
similarity index 99%
rename from Module/Rule.Permission/Convert/Methods.ps1
rename to source/Module/Rule.Permission/Convert/Methods.ps1
index 9f4439c9d..07bb4d291 100644
--- a/Module/Rule.Permission/Convert/Methods.ps1
+++ b/source/Module/Rule.Permission/Convert/Methods.ps1
@@ -546,7 +546,7 @@ function Convert-RightsConstant
             {
                 $string.Split(',')
             }
-            elseIf ( $string.Contains('/') )
+            elseif ($string.Contains('/'))
             {
                 $string.Split('/')
             }
@@ -651,7 +651,7 @@ function Split-MultiplePermissionRule
         $headerLineRange = 0..($hklmSecurityMatch.LineNumber - 2)
         $footerLineRange = ($lastPermissonMatch.LineNumber)..($checkContent.Length - 1)
     }
-    elseIf (
+    elseif (
         $checkContent -match $regularExpression.rootOfC -and
         $checkContent -match $regularExpression.programFilesWin10 -and
         $checkContent -match $regularExpression.winDir
diff --git a/Module/Rule.Permission/Convert/PermissionRule.Convert.psm1 b/source/Module/Rule.Permission/Convert/PermissionRule.Convert.psm1
similarity index 96%
rename from Module/Rule.Permission/Convert/PermissionRule.Convert.psm1
rename to source/Module/Rule.Permission/Convert/PermissionRule.Convert.psm1
index f43c73e28..941e3c378 100644
--- a/Module/Rule.Permission/Convert/PermissionRule.Convert.psm1
+++ b/source/Module/Rule.Permission/Convert/PermissionRule.Convert.psm1
@@ -21,7 +21,7 @@ foreach ($supportFile in $supportFileList)
         permission rule, it is passed to the PermissionRule class for parsing
         and validation.
 #>
-Class PermissionRuleConvert : PermissionRule
+class PermissionRuleConvert : PermissionRule
 {
     <#
         .SYNOPSIS
@@ -37,7 +37,7 @@ Class PermissionRuleConvert : PermissionRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    PermissionRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    PermissionRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetPath()
         $this.SetDscResource()
@@ -121,7 +121,7 @@ Class PermissionRuleConvert : PermissionRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             if ($this.Path)
             {
@@ -141,7 +141,7 @@ Class PermissionRuleConvert : PermissionRule
                     }
                 }
             }
-            elseIf ($this.RawString -match 'Auditing Tab')
+            elseif ($this.RawString -match 'Auditing Tab')
             {
                 $this.DscResource = 'FileSystemAuditRuleEntry'
             }
@@ -163,7 +163,7 @@ Class PermissionRuleConvert : PermissionRule
             $CheckContent -NotMatch 'Windows Registry Editor' -and
             $CheckContent -NotMatch '(ID|id)s? .* (A|a)uditors?,? (SA|sa)s?,? .* (W|w)eb (A|a)dministrators? .* access to log files?' -and
             $CheckContent -NotMatch '\n*\.NET Trust Level' -and
-            $CheckContent -NotMatch 'IIS 8\.5 web' -and
+            $CheckContent -NotMatch 'IIS 8\.5 web|IIS 10\.0 web' -and
             $CheckContent -cNotmatch 'SELECT' -and
             $CheckContent -NotMatch 'SQL Server' -and
             $CheckContent -NotMatch 'user\srights\sand\spermissions' -and
diff --git a/Module/Rule.Permission/PermissionRule.psm1 b/source/Module/Rule.Permission/PermissionRule.psm1
similarity index 93%
rename from Module/Rule.Permission/PermissionRule.psm1
rename to source/Module/Rule.Permission/PermissionRule.psm1
index 29375bfe7..5d4b74ca1 100644
--- a/Module/Rule.Permission/PermissionRule.psm1
+++ b/source/Module/Rule.Permission/PermissionRule.psm1
@@ -16,7 +16,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Force
         A flag that will overwrite the current ACE in the ACL instead of merge
 #>
-Class PermissionRule : Rule
+class PermissionRule : Rule
 {
     [string] $Path
     [object[]] $AccessControlEntry <#(ExceptionValue)#>
@@ -36,7 +36,7 @@ Class PermissionRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    PermissionRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    PermissionRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -48,7 +48,7 @@ Class PermissionRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    PermissionRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    PermissionRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.ProcessMitigation/Convert/Data.ps1 b/source/Module/Rule.ProcessMitigation/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.ProcessMitigation/Convert/Data.ps1
rename to source/Module/Rule.ProcessMitigation/Convert/Data.ps1
diff --git a/Module/Rule.ProcessMitigation/Convert/Methods.ps1 b/source/Module/Rule.ProcessMitigation/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.ProcessMitigation/Convert/Methods.ps1
rename to source/Module/Rule.ProcessMitigation/Convert/Methods.ps1
diff --git a/Module/Rule.ProcessMitigation/Convert/ProcessMitigationRule.Convert.psm1 b/source/Module/Rule.ProcessMitigation/Convert/ProcessMitigationRule.Convert.psm1
similarity index 97%
rename from Module/Rule.ProcessMitigation/Convert/ProcessMitigationRule.Convert.psm1
rename to source/Module/Rule.ProcessMitigation/Convert/ProcessMitigationRule.Convert.psm1
index 8a41645a5..e8661d24f 100644
--- a/Module/Rule.ProcessMitigation/Convert/ProcessMitigationRule.Convert.psm1
+++ b/source/Module/Rule.ProcessMitigation/Convert/ProcessMitigationRule.Convert.psm1
@@ -23,7 +23,7 @@ foreach ($supportFile in $supportFileList)
         for parsing and validation.
 
 #>
-Class ProcessMitigationRuleConvert : ProcessMitigationRule
+class ProcessMitigationRuleConvert : ProcessMitigationRule
 {
     <#
         .SYNOPSIS
@@ -39,7 +39,7 @@ Class ProcessMitigationRuleConvert : ProcessMitigationRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    ProcessMitigationRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    ProcessMitigationRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetMitigationTarget()
         $this.SetMitigationToEnable()
@@ -122,7 +122,7 @@ Class ProcessMitigationRuleConvert : ProcessMitigationRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'ProcessMitigation'
         }
diff --git a/Module/Rule.ProcessMitigation/ProcessMitigationRule.psm1 b/source/Module/Rule.ProcessMitigation/ProcessMitigationRule.psm1
similarity index 91%
rename from Module/Rule.ProcessMitigation/ProcessMitigationRule.psm1
rename to source/Module/Rule.ProcessMitigation/ProcessMitigationRule.psm1
index da1041cc7..3a7eb876b 100644
--- a/Module/Rule.ProcessMitigation/ProcessMitigationRule.psm1
+++ b/source/Module/Rule.ProcessMitigation/ProcessMitigationRule.psm1
@@ -16,7 +16,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Disable
         A flag to disable the mitigation rule
 #>
-Class ProcessMitigationRule : Rule
+class ProcessMitigationRule : Rule
 {
     [string] $MitigationTarget
     [string] $Enable
@@ -36,7 +36,7 @@ Class ProcessMitigationRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    ProcessMitigationRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    ProcessMitigationRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -48,7 +48,7 @@ Class ProcessMitigationRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    ProcessMitigationRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    ProcessMitigationRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.Registry/Convert/Data.ps1 b/source/Module/Rule.Registry/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.Registry/Convert/Data.ps1
rename to source/Module/Rule.Registry/Convert/Data.ps1
diff --git a/Module/Rule.Registry/Convert/Functions.SingleLine.ps1 b/source/Module/Rule.Registry/Convert/Functions.SingleLine.ps1
similarity index 99%
rename from Module/Rule.Registry/Convert/Functions.SingleLine.ps1
rename to source/Module/Rule.Registry/Convert/Functions.SingleLine.ps1
index fd8278534..f524bc967 100644
--- a/Module/Rule.Registry/Convert/Functions.SingleLine.ps1
+++ b/source/Module/Rule.Registry/Convert/Functions.SingleLine.ps1
@@ -216,7 +216,7 @@ function Get-McAfeeRegistryPath
     if ($CheckContent -match "Software\\McAfee")
     {
         $path = "HKEY_LOCAL_MACHINE\Software\Wow6432Node\McAfee\"
-        if($CheckContent -match 'DesktopProtection')
+        if ($CheckContent -match 'DesktopProtection')
         {
             $mcafeePath = $CheckContent | Select-String -Pattern 'DesktopProtection.*$'
         }
diff --git a/Module/Rule.Registry/Convert/Methods.ps1 b/source/Module/Rule.Registry/Convert/Methods.ps1
similarity index 95%
rename from Module/Rule.Registry/Convert/Methods.ps1
rename to source/Module/Rule.Registry/Convert/Methods.ps1
index 1973e9f48..ee7fcdeb3 100644
--- a/Module/Rule.Registry/Convert/Methods.ps1
+++ b/source/Module/Rule.Registry/Convert/Methods.ps1
@@ -1050,7 +1050,7 @@ function Split-MultipleRegistryEntries
             If a check contains only the registry hive, but have multiple/unique paths,type,names,and values, then reference the single
             hive for each path that is discovered.
         #>
-        elseIf ( $paths.count -gt 1 -and $types.count -eq 1 -and $names.count -eq 1 -and $values.count -eq 1 )
+        elseif ($paths.count -gt 1 -and $types.count -eq 1 -and $names.count -eq 1 -and $values.count -eq 1)
         {
             Write-Verbose -Message "[$($MyInvocation.MyCommand.Name)] Paths : $($paths.count)"
 
@@ -1071,7 +1071,7 @@ function Split-MultipleRegistryEntries
             If a check contains a single registry hive, path, type, and value, but multiple value names, then reference
             the single hive hive, path, type, and value for each value name that is discovered.
         #>
-        elseIf ( $names.count -gt 1 -and $types.count -eq 1 -and $values.count -eq 1 )
+        elseif ($names.count -gt 1 -and $types.count -eq 1 -and $values.count -eq 1)
         {
             Write-Verbose -Message "[$($MyInvocation.MyCommand.Name)] Values : $($names.count)"
 
@@ -1092,7 +1092,7 @@ function Split-MultipleRegistryEntries
             If a check contains a single registry hive and path, but multiple values, then reference
             the single hive and path for each value name that is discovered.
         #>
-        elseIf ( $names.count -gt 1 -and $types.count -gt 1 )
+        elseif ($names.count -gt 1 -and $types.count -gt 1)
         {
             Write-Verbose -Message "[$($MyInvocation.MyCommand.Name)] Values : $($names.count)"
 
@@ -1109,7 +1109,7 @@ function Split-MultipleRegistryEntries
                 $registryEntryCounter ++
             }
         }
-        elseIf ( $hives.count -eq 1 -and $paths.count -gt 1 -and $types.count -eq 1 -and $names.count -eq 1 -and $values.count -eq 1 )
+        elseif ($hives.count -eq 1 -and $paths.count -gt 1 -and $types.count -eq 1 -and $names.count -eq 1 -and $values.count -eq 1)
         {
             foreach ( $registryRule in $names )
             {
@@ -1124,9 +1124,9 @@ function Split-MultipleRegistryEntries
                 $registryEntryCounter ++
             }
         }
-        elseIf ( $hives.count -eq 1 -and $paths.count -eq 1 -and $types.count -eq 1 -and $names.count -gt 1 -and $values.count -gt 1 )
+        elseif ($hives.count -eq 1 -and $paths.count -eq 1 -and $types.count -eq 1 -and $names.count -gt 1 -and $values.count -gt 1)
         {
-            foreach ( $registryRule in $values )
+            foreach ($registryRule in $values)
             {
                 $newSplitRegistryEntry = @(
                     $hives[0],
@@ -1166,56 +1166,56 @@ function Set-RegistryPatternLog
     (
         [Parameter(Mandatory = $true)]
         [string]
-        $Pattern, 
+        $Pattern,
 
         [Parameter()]
         [string]
         $Rule
     )
-    
-    <# 
+
+    <#
        Load table with patterns from Core data file.
        Build the in-memory table of patterns
     #>
-    if(-not $global:patternTable)
+    if (-not $global:patternTable)
     {
-        $nonestedItems = $global:SingleLineRegistryPath.GetEnumerator() | 
+        $nonestedItems = $global:SingleLineRegistryPath.GetEnumerator() |
         Where-Object { $_.Value['Select'] -ne $null }
-        
-        $nestedItems = $global:SingleLineRegistryPath.GetEnumerator() | 
+
+        $nestedItems = $global:SingleLineRegistryPath.GetEnumerator() |
         Where-Object { $_.Value['Select'] -eq $null } | Select-Object {$_.Value } -ExpandProperty Value
 
-        $regPathTable = $nonestedItems.GetEnumerator() | 
+        $regPathTable = $nonestedItems.GetEnumerator() |
         ForEach-Object { New-Object -TypeName PSObject -Property @{Pattern=$_.Value['Select']; Count=0; Type='RegistryPath'}}
-        
-        $regPathTable += $nestedItems.GetEnumerator() | 
-        Where-Object { $_.Value['Select'] -ne $null } | 
+
+        $regPathTable += $nestedItems.GetEnumerator() |
+        Where-Object { $_.Value['Select'] -ne $null } |
         ForEach-Object { New-Object -TypeName PSObject -Property @{Pattern=$_.Value['Select']; Count=0; Type='RegistryPath'}}
-        
-        $regValueTypeTable = $global:SingleLineRegistryValueType.GetEnumerator() | 
-        Where-Object { $_.Value['Select'] -ne $null } | 
+
+        $regValueTypeTable = $global:SingleLineRegistryValueType.GetEnumerator() |
+        Where-Object { $_.Value['Select'] -ne $null } |
         ForEach-Object { New-Object -TypeName PSObject -Property @{Pattern=$_.Value['Select']; Count=0; Type='ValueType'}}
-        
-        $regValueNameTable = $global:SingleLineRegistryValueName.GetEnumerator() | 
-        Where-Object { $_.Value['Select'] -ne $null } | 
+
+        $regValueNameTable = $global:SingleLineRegistryValueName.GetEnumerator() |
+        Where-Object { $_.Value['Select'] -ne $null } |
         ForEach-Object { New-Object -TypeName PSObject -Property @{Pattern=$_.Value['Select']; Count=0; Type='ValueName'}}
-        
-        $regValueDataTable = $global:SingleLineRegistryValueData.GetEnumerator() | 
-        Where-Object { $_.Value['Select'] -ne $null } | 
+
+        $regValueDataTable = $global:SingleLineRegistryValueData.GetEnumerator() |
+        Where-Object { $_.Value['Select'] -ne $null } |
         ForEach-Object { New-Object -TypeName PSObject -Property @{Pattern=$_.Value['Select']; Count=0; Type='ValueData'}}
-        
-        $valueTypeTable = $regValueTypeTable | 
-        Group-Object -Property "Pattern" | 
+
+        $valueTypeTable = $regValueTypeTable |
+        Group-Object -Property "Pattern" |
         ForEach-Object{ $_.Group | Select-Object 'Pattern','Count', 'Type' -First 1}
-        
-        $valueNameTable = $regValueNameTable | 
-        Group-Object -Property "Pattern" | 
+
+        $valueNameTable = $regValueNameTable |
+        Group-Object -Property "Pattern" |
         ForEach-Object{ $_.Group | Select-Object 'Pattern','Count', 'Type' -First 1}
 
-        $valueDataTable = $regValueDataTable | 
-        Group-Object -Property "Pattern" | 
+        $valueDataTable = $regValueDataTable |
+        Group-Object -Property "Pattern" |
         ForEach-Object{ $_.Group | Select-Object 'Pattern','Count', 'Type' -First 1}
-        
+
         $global:patternTable = $regPathTable + $valueTypeTable + $valueNameTable + $valueDataTable
     }
 
@@ -1233,7 +1233,7 @@ function Set-RegistryPatternLog
 
     .PARAMETER Path
         Specifies a path to a directory with (unprocessed) xccdf.xml files or a specific xccdf.xml file.
-        Path should be StigData\Archive\{Directory Name} or StigData\Archive\{DirectoryName}\{*.xccdf.xml} 
+        Path should be StigData\Archive\{Directory Name} or StigData\Archive\{DirectoryName}\{*.xccdf.xml}
 
     .Notes
         Expression patterns are only for Registry Rules, this could change in the future
@@ -1264,7 +1264,7 @@ function Get-RegistryPatternLog
                 }
             }
         }
-        
+
         # If $Path is a file, process it
         $isFile = Test-Path $Path -pathType Leaf
         if ($isFile)
@@ -1312,22 +1312,22 @@ function Test-StigProcessed
     # Setup, check $Path for Processed
     [xml]$XmlDocument = Get-Content -Path $Path
     $id = $XmlDocument.Benchmark | Select-Object id
-    
-    $version = $Path | Select-String -Pattern '(?<=_)V.*(?=_)' | 
+
+    $version = $Path | Select-String -Pattern '(?<=_)V.*(?=_)' |
     ForEach-Object { $_.Matches[0] -replace "V", "" -replace "R","\." }
 
     $conversionPath = Get-Item "$($PSScriptRoot)..\..\..\StigData\Processed"
     #Write-Host $testPath
-    $hasConversion = Get-ChildItem -Path $conversionPath -recurse | Where-Object { $_ | Select-String -Pattern $id.id } | Where-Object { $_ | Select-String -Pattern $version } 
-    #$hasConversion = Get-ChildItem -Path ..\..\..\StigData\Processed -recurse | Where-Object { $_ | Select-String -Pattern $id.id } | Where-Object { $_ | Select-String -Pattern $version } 
-    
+    $hasConversion = Get-ChildItem -Path $conversionPath -recurse | Where-Object { $_ | Select-String -Pattern $id.id } | Where-Object { $_ | Select-String -Pattern $version }
+    #$hasConversion = Get-ChildItem -Path ..\..\..\StigData\Processed -recurse | Where-Object { $_ | Select-String -Pattern $id.id } | Where-Object { $_ | Select-String -Pattern $version }
+
     if ($hasConversion)
     {
         return $true
     }
-    else 
-    {  
-        return $false      
+    else
+    {
+        return $false
     }
 }
 #endregion
diff --git a/Module/Rule.Registry/Convert/RegistryRule.Convert.psm1 b/source/Module/Rule.Registry/Convert/RegistryRule.Convert.psm1
similarity index 99%
rename from Module/Rule.Registry/Convert/RegistryRule.Convert.psm1
rename to source/Module/Rule.Registry/Convert/RegistryRule.Convert.psm1
index 1bf6e01ab..ae3ea7b54 100644
--- a/Module/Rule.Registry/Convert/RegistryRule.Convert.psm1
+++ b/source/Module/Rule.Registry/Convert/RegistryRule.Convert.psm1
@@ -22,7 +22,7 @@ foreach ($supportFile in $supportFileList)
         registry rule, it is passed to the RegistryRule class for parsing
         and validation.
 #>
-Class RegistryRuleConvert : RegistryRule
+class RegistryRuleConvert : RegistryRule
 {
     <#
         .SYNOPSIS
@@ -38,9 +38,8 @@ Class RegistryRuleConvert : RegistryRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    RegistryRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    RegistryRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
-
         $fixText = [RegistryRule]::GetFixText($XccdfRule)
 
         if ($global:stigTitle -match 'Adobe Acrobat Reader')
@@ -368,7 +367,7 @@ Class RegistryRuleConvert : RegistryRule
 
     hidden [void] SetDscResource ([string] $FixText)
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             if ($FixText -match 'Administrative Templates' -or $this.key -match "(^hkcu|^HKEY_CURRENT_USER)")
             {
diff --git a/Module/Rule.Registry/RegistryRule.psm1 b/source/Module/Rule.Registry/RegistryRule.psm1
similarity index 92%
rename from Module/Rule.Registry/RegistryRule.psm1
rename to source/Module/Rule.Registry/RegistryRule.psm1
index 2c1a624d8..ef23df226 100644
--- a/Module/Rule.Registry/RegistryRule.psm1
+++ b/source/Module/Rule.Registry/RegistryRule.psm1
@@ -23,7 +23,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Ensure
         A present or absent flag
 #>
-Class RegistryRule : Rule
+class RegistryRule : Rule
 {
     [string] $Key
     [string] $ValueName
@@ -45,7 +45,7 @@ Class RegistryRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    RegistryRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    RegistryRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -57,7 +57,7 @@ Class RegistryRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    RegistryRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    RegistryRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.SecurityOption/Convert/SecurityOptionRule.Convert.psm1 b/source/Module/Rule.SecurityOption/Convert/SecurityOptionRule.Convert.psm1
similarity index 97%
rename from Module/Rule.SecurityOption/Convert/SecurityOptionRule.Convert.psm1
rename to source/Module/Rule.SecurityOption/Convert/SecurityOptionRule.Convert.psm1
index 0468f2abb..1e26aa7ce 100644
--- a/Module/Rule.SecurityOption/Convert/SecurityOptionRule.Convert.psm1
+++ b/source/Module/Rule.SecurityOption/Convert/SecurityOptionRule.Convert.psm1
@@ -14,7 +14,7 @@ using namespace System.Text
         Security Option rule. The configuration details are then extracted and
         validated before returning the object.
 #>
-Class SecurityOptionRuleConvert : SecurityOptionRule
+class SecurityOptionRuleConvert : SecurityOptionRule
 {
     <#
         .SYNOPSIS
@@ -30,7 +30,7 @@ Class SecurityOptionRuleConvert : SecurityOptionRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    SecurityOptionRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    SecurityOptionRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         [System.Text.RegularExpressions.Match] $tokens = $this.ExtractProperties()
         $this.SetOptionName($tokens)
@@ -144,7 +144,7 @@ Class SecurityOptionRuleConvert : SecurityOptionRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'SecurityOption'
         }
diff --git a/Module/Rule.SecurityOption/SecurityOptionRule.psm1 b/source/Module/Rule.SecurityOption/SecurityOptionRule.psm1
similarity index 92%
rename from Module/Rule.SecurityOption/SecurityOptionRule.psm1
rename to source/Module/Rule.SecurityOption/SecurityOptionRule.psm1
index 3f75ae35f..8bfa7aabc 100644
--- a/Module/Rule.SecurityOption/SecurityOptionRule.psm1
+++ b/source/Module/Rule.SecurityOption/SecurityOptionRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER OptionValue
         The security option value
 #>
-Class SecurityOptionRule : Rule
+class SecurityOptionRule : Rule
 {
     [ValidateNotNullOrEmpty()] [string] $OptionName
     [ValidateNotNullOrEmpty()] [string] $OptionValue <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class SecurityOptionRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    SecurityOptionRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    SecurityOptionRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class SecurityOptionRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    SecurityOptionRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    SecurityOptionRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.Service/Convert/Data.ps1 b/source/Module/Rule.Service/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.Service/Convert/Data.ps1
rename to source/Module/Rule.Service/Convert/Data.ps1
diff --git a/Module/Rule.Service/Convert/Methods.ps1 b/source/Module/Rule.Service/Convert/Methods.ps1
similarity index 85%
rename from Module/Rule.Service/Convert/Methods.ps1
rename to source/Module/Rule.Service/Convert/Methods.ps1
index 1fb8c460b..c7551b135 100644
--- a/Module/Rule.Service/Convert/Methods.ps1
+++ b/source/Module/Rule.Service/Convert/Methods.ps1
@@ -18,19 +18,19 @@ function Get-ServiceName
 
     Write-Verbose "[$($MyInvocation.MyCommand.Name)]"
 
-    if ( $checkContent -match $regularExpression.McAfee )
+    if ( $checkContent -match $regularExpression.McAfee)
     {
         $serviceName = 'masvc'
     }
-    elseif ( $checkContent -match $regularExpression.SmartCardRemovalPolicy )
+    elseif ($checkContent -match $regularExpression.SmartCardRemovalPolicy)
     {
         $serviceName = 'SCPolicySvc'
     }
-    elseif ( $checkContent -match $regularExpression.SecondaryLogon )
+    elseif ($checkContent -match $regularExpression.SecondaryLogon)
     {
         $serviceName = 'seclogon'
     }
-    elseif ( $checkContent -match $regularExpression.followingservices )
+    elseif ($checkContent -match $regularExpression.followingservices)
     {
         $regexMatch = $checkContent | Select-String '-'
         $svcArray = @()
@@ -58,8 +58,8 @@ function Get-ServiceName
             $serviceName = $regexMatch.matches.groups[-1].Value
         }
     }
-    <# 
-       There is an edge case with the rule concerning the FTP Service. All service rules have the service names inside of parentheses 
+    <#
+       There is an edge case with the rule concerning the FTP Service. All service rules have the service names inside of parentheses
        (ex. (servicename)), however the rule pertaining to the FTP service presents this scenario: (Service name: FTPSVC)
     #>
     if ( $serviceName -match 'Service name: FTPSVC' )
@@ -109,16 +109,16 @@ function Get-ServiceState
     $serviceName = Get-ServiceName -CheckContent $checkContent
 
     # ServiceState McAfee and Smartcard is running everything else is stopped
-    if ( $serviceName -match 'masvc' -or $serviceName -eq 'SCPolicySvc' )
+    if ($serviceName -match 'masvc' -or $serviceName -eq 'SCPolicySvc')
     {
         return 'Running'
     }
-    elseif ( $checkContent -match 'is installed and not disabled, this is a finding' )
+    elseif ($checkContent -match 'is installed and not disabled, this is a finding')
     {
         return 'Stopped'
     }
-    elseif ( $checkContent -match 'is not set to Automatic, this is a finding' -or
-             $checkContent -match 'is not Automatic, this is a finding' )
+    elseif ($checkContent -match 'is not set to Automatic, this is a finding' -or
+             $checkContent -match 'is not Automatic, this is a finding')
     {
         return 'Running'
     }
@@ -148,16 +148,16 @@ function Get-ServiceStartupType
     $serviceName = Get-ServiceName -CheckContent $checkContent
 
     # StartupType McAfee and Smartcard is Automatic everything else is disabled
-    if ( $serviceName -match 'masvc' -or $serviceName -eq 'SCPolicySvc' )
+    if ($serviceName -match 'masvc' -or $serviceName -eq 'SCPolicySvc')
     {
         return 'Automatic'
     }
-    elseif ( $checkContent -match 'is installed and not disabled, this is a finding' )
+    elseif ($checkContent -match 'is installed and not disabled, this is a finding')
     {
         return 'Disabled'
     }
-    elseif ( $checkContent -match 'is not set to Automatic, this is a finding' -or
-        $checkContent -match 'is not Automatic, this is a finding' )
+    elseif ($checkContent -match 'is not set to Automatic, this is a finding' -or
+        $checkContent -match 'is not Automatic, this is a finding')
     {
         return 'Automatic'
     }
diff --git a/Module/Rule.Service/Convert/ServiceRule.Convert.psm1 b/source/Module/Rule.Service/Convert/ServiceRule.Convert.psm1
similarity index 97%
rename from Module/Rule.Service/Convert/ServiceRule.Convert.psm1
rename to source/Module/Rule.Service/Convert/ServiceRule.Convert.psm1
index e9a22212a..029b281b1 100644
--- a/Module/Rule.Service/Convert/ServiceRule.Convert.psm1
+++ b/source/Module/Rule.Service/Convert/ServiceRule.Convert.psm1
@@ -20,7 +20,7 @@ foreach ($supportFile in $supportFileList)
         check-content of the xccdf. Once a STIG rule is identified a service rule,
         it is passed to the ServiceRule class for parsing and validation.
 #>
-Class ServiceRuleConvert : ServiceRule
+class ServiceRuleConvert : ServiceRule
 {
     <#
         .SYNOPSIS
@@ -36,7 +36,7 @@ Class ServiceRuleConvert : ServiceRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    ServiceRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    ServiceRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetServiceName()
         $this.SetServiceState()
@@ -153,7 +153,7 @@ Class ServiceRuleConvert : ServiceRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'Service'
         }
diff --git a/Module/Rule.Service/ServiceRule.psm1 b/source/Module/Rule.Service/ServiceRule.psm1
similarity index 91%
rename from Module/Rule.Service/ServiceRule.psm1
rename to source/Module/Rule.Service/ServiceRule.psm1
index 722613b32..2d78eb4ac 100644
--- a/Module/Rule.Service/ServiceRule.psm1
+++ b/source/Module/Rule.Service/ServiceRule.psm1
@@ -18,7 +18,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Ensure
         A present or absent flag
 #>
-Class ServiceRule : Rule
+class ServiceRule : Rule
 {
     [string] $ServiceName
     [string] $ServiceState
@@ -39,7 +39,7 @@ Class ServiceRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    ServiceRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    ServiceRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -51,7 +51,7 @@ Class ServiceRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    ServiceRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    ServiceRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.Skip/Skip.psm1 b/source/Module/Rule.Skip/Skip.psm1
similarity index 94%
rename from Module/Rule.Skip/Skip.psm1
rename to source/Module/Rule.Skip/Skip.psm1
index 7ff16c97c..891af6eb8 100644
--- a/Module/Rule.Skip/Skip.psm1
+++ b/source/Module/Rule.Skip/Skip.psm1
@@ -16,7 +16,7 @@ using module .\..\Rule\Rule.psm1
     .NOTES
         This class requires PowerShell v5 or above.
 #>
-Class SkippedRule : Rule
+class SkippedRule : Rule
 {
     <#
         .SYNOPSIS
@@ -40,7 +40,7 @@ Class SkippedRule : Rule
         .PARAMETER Rule
             The Stig Rule
     #>
-    SkippedRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    SkippedRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
         $this.UpdateRuleTitle('Skip')
     }
diff --git a/Module/Rule.SqlScriptQuery/Convert/Methods.ps1 b/source/Module/Rule.SqlScriptQuery/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.SqlScriptQuery/Convert/Methods.ps1
rename to source/Module/Rule.SqlScriptQuery/Convert/Methods.ps1
diff --git a/Module/Rule.SqlScriptQuery/Convert/SqlScriptQueryRule.Convert.psm1 b/source/Module/Rule.SqlScriptQuery/Convert/SqlScriptQueryRule.Convert.psm1
similarity index 97%
rename from Module/Rule.SqlScriptQuery/Convert/SqlScriptQueryRule.Convert.psm1
rename to source/Module/Rule.SqlScriptQuery/Convert/SqlScriptQueryRule.Convert.psm1
index 18be67b3c..17089bc9e 100644
--- a/Module/Rule.SqlScriptQuery/Convert/SqlScriptQueryRule.Convert.psm1
+++ b/source/Module/Rule.SqlScriptQuery/Convert/SqlScriptQueryRule.Convert.psm1
@@ -22,7 +22,7 @@ foreach ($supportFile in $supportFileList)
         SQL script query rule, it is passed to the SqlScriptQueryRule class for
         parsing and validation.
     #>
-Class SqlScriptQueryRuleConvert : SqlScriptQueryRule
+class SqlScriptQueryRuleConvert : SqlScriptQueryRule
 {
     <#
         .SYNOPSIS
@@ -38,7 +38,7 @@ Class SqlScriptQueryRuleConvert : SqlScriptQueryRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    SqlScriptQueryRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    SqlScriptQueryRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $ruleType = $this.GetRuleType($this.splitCheckContent)
         $fixText = [SqlScriptQueryRule]::GetFixText($XccdfRule)
@@ -154,7 +154,7 @@ Class SqlScriptQueryRuleConvert : SqlScriptQueryRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'SqlScriptQuery'
         }
@@ -166,7 +166,7 @@ Class SqlScriptQueryRuleConvert : SqlScriptQueryRule
 
     static [bool] Match ([string] $CheckContent)
     {
-        <# 
+        <#
             Provide match criteria to validate that the rule is (or is not) a SQL rule.
             Standard match rules
         #>
diff --git a/Module/Rule.SqlScriptQuery/SqlScriptQueryRule.psm1 b/source/Module/Rule.SqlScriptQuery/SqlScriptQueryRule.psm1
similarity index 92%
rename from Module/Rule.SqlScriptQuery/SqlScriptQueryRule.psm1
rename to source/Module/Rule.SqlScriptQuery/SqlScriptQueryRule.psm1
index dcc1a2308..4391667d1 100644
--- a/Module/Rule.SqlScriptQuery/SqlScriptQueryRule.psm1
+++ b/source/Module/Rule.SqlScriptQuery/SqlScriptQueryRule.psm1
@@ -16,7 +16,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER SetScript
         The set script content
 #>
-Class SqlScriptQueryRule : Rule
+class SqlScriptQueryRule : Rule
 {
     [string] $GetScript
     [string] $TestScript
@@ -38,7 +38,7 @@ Class SqlScriptQueryRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    SqlScriptQueryRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    SqlScriptQueryRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -50,7 +50,7 @@ Class SqlScriptQueryRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    SqlScriptQueryRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    SqlScriptQueryRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.SslSettings/Convert/SslSettingsRule.Convert.psm1 b/source/Module/Rule.SslSettings/Convert/SslSettingsRule.Convert.psm1
similarity index 94%
rename from Module/Rule.SslSettings/Convert/SslSettingsRule.Convert.psm1
rename to source/Module/Rule.SslSettings/Convert/SslSettingsRule.Convert.psm1
index 11970da57..f774728f4 100644
--- a/Module/Rule.SslSettings/Convert/SslSettingsRule.Convert.psm1
+++ b/source/Module/Rule.SslSettings/Convert/SslSettingsRule.Convert.psm1
@@ -13,7 +13,7 @@ using module .\..\SslSettingsRule.psm1
         rule is identified as a web configuration property rule, it is passed
         to the WebConfigurationPropertyRule class for parsing and validation.
 #>
-Class SslSettingsRuleConvert : SslSettingsRule
+class SslSettingsRuleConvert : SslSettingsRule
 {
     <#
         .SYNOPSIS
@@ -29,7 +29,7 @@ Class SslSettingsRuleConvert : SslSettingsRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    SslSettingsRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    SslSettingsRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetSslValue()
 
@@ -86,7 +86,7 @@ Class SslSettingsRuleConvert : SslSettingsRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'xSslSettings'
         }
diff --git a/Module/Rule.SslSettings/SslSettingsRule.psm1 b/source/Module/Rule.SslSettings/SslSettingsRule.psm1
similarity index 91%
rename from Module/Rule.SslSettings/SslSettingsRule.psm1
rename to source/Module/Rule.SslSettings/SslSettingsRule.psm1
index c477a6a62..ea88c5090 100644
--- a/Module/Rule.SslSettings/SslSettingsRule.psm1
+++ b/source/Module/Rule.SslSettings/SslSettingsRule.psm1
@@ -12,7 +12,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Value
         The value the bindings should be set to
 #>
-Class SslSettingsRule : Rule
+class SslSettingsRule : Rule
 {
     [string] $Value <#(ExceptionValue)#>
 
@@ -30,7 +30,7 @@ Class SslSettingsRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    SslSettingsRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    SslSettingsRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -42,7 +42,7 @@ Class SslSettingsRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    SslSettingsRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    SslSettingsRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.UserRight/Convert/Data.ps1 b/source/Module/Rule.UserRight/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.UserRight/Convert/Data.ps1
rename to source/Module/Rule.UserRight/Convert/Data.ps1
diff --git a/Module/Rule.UserRight/Convert/Methods.ps1 b/source/Module/Rule.UserRight/Convert/Methods.ps1
similarity index 87%
rename from Module/Rule.UserRight/Convert/Methods.ps1
rename to source/Module/Rule.UserRight/Convert/Methods.ps1
index d71c64147..84dc2a8d0 100644
--- a/Module/Rule.UserRight/Convert/Methods.ps1
+++ b/source/Module/Rule.UserRight/Convert/Methods.ps1
@@ -94,15 +94,15 @@ function Get-UserRightIdentity
     {
         [void] $return.Add('Administrators')
     }
-    elseif ( $checkContent -Match "If (any|the following){1} (accounts or groups|groups or accounts) (other than the following|are not defined){1}.*this is a finding" )
+    elseif ($checkContent -Match "If (any|the following){1} (accounts or groups|groups or accounts) (other than the following|are not defined){1}.*this is a finding")
     {
         Write-Verbose "[$($MyInvocation.MyCommand.Name)] Ensure : Present"
         # There is an edge case where multiple finding statements are made, so a zero index is needed.
-        [int] $lineNumber = ( ( $checkContent | Select-String "this is a finding" )[0] ).LineNumber
+        [int] $lineNumber = (($checkContent | Select-String "this is a finding")[0]).LineNumber
         # Set the negative index number of the first group to process.
         $startLine = $lineNumber - $checkContent.Count
 
-        foreach ( $line in $checkContent[$startLine..-1] )
+        foreach ($line in $checkContent[$startLine..-1])
         {
             <#
                 The Windows Server 2016 STIG prepends each identity with a dash space (- )
@@ -124,16 +124,16 @@ function Get-UserRightIdentity
                 {
                     [void] $return.Add("{Hyper-V}")
                 }
-                elseif ( $line.Trim() -match "(^Enterprise|^Domain) (Admins|Admin)|^Guests" )
+                elseif ($line.Trim() -match "(^Enterprise|^Domain) (Admins|Admin)|^Guests")
                 {
-                    if ( $line -match '\sAdmin\s' )
+                    if ($line -match '\sAdmin\s')
                     {
                         $line = $line -replace 'Admin', 'Admins'
                     }
                     # .Trim method is case sensitive, so the replace operator is used instead
-                    [void] $return.Add( $($line.Trim() -replace ' Group').Trim() )
+                    [void] $return.Add($($line.Trim() -replace ' Group').Trim())
                 }
-                elseIf ($line.Trim() -match '"Local account and member of Administrators group" or "Local account"')
+                elseif ($line.Trim() -match '"Local account and member of Administrators group" or "Local account"')
                 {
                     [void] $return.Add('(Local account and member of Administrators group|Local account)')
                 }
@@ -148,7 +148,7 @@ function Get-UserRightIdentity
             }
         }
     }
-    elseif ( $checkContent -Match "If any (accounts or groups|groups or accounts).*are (granted|defined).*this is a finding" )
+    elseif ($checkContent -Match "If any (accounts or groups|groups or accounts).*are (granted|defined).*this is a finding")
     {
         Write-Verbose "[$($MyInvocation.MyCommand.Name)] Ensure : Absent"
 
@@ -173,11 +173,11 @@ function Test-SetForceFlag
         $CheckContent
     )
 
-    if ( $checkContent -match 'If any (accounts or groups|groups or accounts) other than the following' )
+    if ($checkContent -match 'If any (accounts or groups|groups or accounts) other than the following')
     {
         return $true
     }
-    elseif ( $checkContent -match 'If any (accounts or groups|groups or accounts)\s*(\(.*\),)?\s*are (granted|defined)' )
+    elseif ($checkContent -match 'If any (accounts or groups|groups or accounts)\s*(\(.*\),)?\s*are (granted|defined)')
     {
         return $true
     }
diff --git a/Module/Rule.UserRight/Convert/UserRightRule.Convert.psm1 b/source/Module/Rule.UserRight/Convert/UserRightRule.Convert.psm1
similarity index 97%
rename from Module/Rule.UserRight/Convert/UserRightRule.Convert.psm1
rename to source/Module/Rule.UserRight/Convert/UserRightRule.Convert.psm1
index fa2dfaee0..ceb2f4cec 100644
--- a/Module/Rule.UserRight/Convert/UserRightRule.Convert.psm1
+++ b/source/Module/Rule.UserRight/Convert/UserRightRule.Convert.psm1
@@ -21,7 +21,7 @@ foreach ($supportFile in $supportFileList)
         user right rule, it is passed to the UserRightRule class for parsing
         and validation.
 #>
-Class UserRightRuleConvert : UserRightRule
+class UserRightRuleConvert : UserRightRule
 {
     <#
         .SYNOPSIS
@@ -37,7 +37,7 @@ Class UserRightRuleConvert : UserRightRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    UserRightRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    UserRightRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetDisplayName()
         $this.SetConstant()
@@ -146,7 +146,7 @@ Class UserRightRuleConvert : UserRightRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'UserRightsAssignment'
         }
diff --git a/Module/Rule.UserRight/UserRightRule.psm1 b/source/Module/Rule.UserRight/UserRightRule.psm1
similarity index 93%
rename from Module/Rule.UserRight/UserRightRule.psm1
rename to source/Module/Rule.UserRight/UserRightRule.psm1
index 510166678..33e468097 100644
--- a/Module/Rule.UserRight/UserRightRule.psm1
+++ b/source/Module/Rule.UserRight/UserRightRule.psm1
@@ -18,7 +18,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Force
         A flag that replaces the identities vs append
 #>
-Class UserRightRule : Rule
+class UserRightRule : Rule
 {
     [ValidateNotNullOrEmpty()] [string] $DisplayName
     [ValidateNotNullOrEmpty()] [string] $Constant
@@ -39,7 +39,7 @@ Class UserRightRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    UserRightRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    UserRightRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -51,7 +51,7 @@ Class UserRightRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    UserRightRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    UserRightRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/source/Module/Rule.VsphereAcceptanceLevel/Convert/Methods.ps1 b/source/Module/Rule.VsphereAcceptanceLevel/Convert/Methods.ps1
new file mode 100644
index 000000000..703ab43c4
--- /dev/null
+++ b/source/Module/Rule.VsphereAcceptanceLevel/Convert/Methods.ps1
@@ -0,0 +1,37 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        Takes the Name property from a VsphereAcceptanceLevelRule.
+
+    .PARAMETER CheckContent
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereAcceptanceLevel
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $Fixtext
+    )
+
+    if ($Fixtext -match 'software.acceptance')
+    {
+        $acceptanceLevel = ($FixText | Select-String -Pattern '(?<=acceptance.Set\(")([^"]+)').Matches.Value
+    }
+
+    if ($null -ne $acceptanceLevel)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found Acceptance Level: {0}" -f $acceptanceLevel)
+        return $acceptanceLevel
+    }
+    else
+    {
+        return $null
+    }
+}
diff --git a/source/Module/Rule.VsphereAcceptanceLevel/Convert/VsphereAcceptanceLevelRule.Convert.psm1 b/source/Module/Rule.VsphereAcceptanceLevel/Convert/VsphereAcceptanceLevelRule.Convert.psm1
new file mode 100644
index 000000000..35882a75a
--- /dev/null
+++ b/source/Module/Rule.VsphereAcceptanceLevel/Convert/VsphereAcceptanceLevelRule.Convert.psm1
@@ -0,0 +1,81 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VsphereAcceptanceLevelRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose -Message "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a Vsphere object.
+    .DESCRIPTION
+        The VsphereRule Acceptance Level class is used to extract the Vsphere settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        Vsphere Acceptance Level rule, it is passed to the VsphereRule Acceptance Level class for parsing
+        and validation.
+#>
+class VsphereAcceptanceLevelRuleConvert : VsphereAcceptanceLevelRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory
+    #>
+    VsphereAcceptanceLevelRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Rule
+        .PARAMETER XccdfRule
+            The STIG rule to convert
+    #>
+    VsphereAcceptanceLevelRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        $fixText = [VsphereAcceptanceLevelRule]::GetFixText($XccdfRule)
+        $this.SetVsphereAcceptanceLevel($fixtext)
+        $this.SetDscResource()
+    }
+
+    <#
+    .SYNOPSIS
+        Extracts the acceptance level from the fix text and sets the level
+    .DESCRIPTION
+        Gets the accceptance leve from the xccdf content and sets the level.
+        If the level that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereAcceptanceLevel ([string[]] $Fixtext)
+    {
+        $vsphereAcceptanceLevel = Get-VsphereAcceptanceLevel -FixText $Fixtext
+        $this.set_Level($vsphereAcceptanceLevel)
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostAcceptanceLevel'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'software.acceptance')
+        {
+            return $true
+        }
+
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VsphereAcceptanceLevel/VsphereAcceptanceLevelRule.psm1 b/source/Module/Rule.VsphereAcceptanceLevel/VsphereAcceptanceLevelRule.psm1
new file mode 100644
index 000000000..a5214dc4b
--- /dev/null
+++ b/source/Module/Rule.VsphereAcceptanceLevel/VsphereAcceptanceLevelRule.psm1
@@ -0,0 +1,59 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+
+<#
+    .SYNOPSIS
+        An Vsphere AcceptanceLevel Rule object.
+    .DESCRIPTION
+        The Vsphere class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER Level
+        The acceptance level of supported VIBs. (i.e. VMwareCertified, VMwareAccepted, PartnerSupported, or CommunitySupported).
+#>
+class VsphereAcceptanceLevelRule : Rule
+{
+    [string] $Level
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method
+    #>
+    VsphereAcceptanceLevelRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory
+        .PARAMETER Rule
+            The STIG rule to load
+    #>
+    VsphereAcceptanceLevelRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor
+        .PARAMETER Rule
+            The STIG rule to convert
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature
+    #>
+    VsphereAcceptanceLevelRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VsphereAdvancedSettings/Convert/Methods.ps1 b/source/Module/Rule.VsphereAdvancedSettings/Convert/Methods.ps1
new file mode 100644
index 000000000..97c5f2dbf
--- /dev/null
+++ b/source/Module/Rule.VsphereAdvancedSettings/Convert/Methods.ps1
@@ -0,0 +1,96 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        Takes the AdvancedSettings property from a VsphereAdvancedSettingsRule.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the Fix Text of the STIG.
+
+    .PARAMETER CheckContent
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereAdvancedSettings
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText,
+
+        [Parameter()]
+        [psobject]
+        $CheckContent
+    )
+
+    if ($FixText -match 'Get-AdvancedSetting')
+    {
+        $matchName = ($FixText | Select-String -Pattern '(?<=Get-AdvancedSetting -Name )([^\s]+)' -AllMatches).Matches.Value
+        $matchValue = ($FixText | Select-String -Pattern '(?<=Set-AdvancedSetting -Value |Set-AdvancedSetting -Value ")[^"]+' -AllMatches).Matches.Value
+        $advancedSettings = "'{0}' = '{1}'" -f $matchName, $matchValue
+    }
+
+    switch ($matchName)
+    {
+        {$PSItem -eq "Annotations.WelcomeMessage"}
+        {
+            $matchValue = ($CheckContent | Select-String -Pattern 'You are accessing[^"]+(?<=details.)').Matches.Value
+            $advancedSettings = "'{0}' = '{1}'" -f $matchName,$matchValue
+        }
+        {$PSItem -eq "Config.Etc.issue"}
+        {
+            $matchValue = ($CheckContent | Select-String -Pattern 'You are accessing[^"]+').Matches.Value
+            $advancedSettings = "'{0}' = '{1}'" -f $matchName,$matchValue
+        }
+        {$PSItem -eq "Net.DVFilterBindIpAddress"}
+        {
+            $advancedSettings = "'{0}' = ''" -f $matchName
+        }
+        {$PSItem -match "Syslog.global.logHost|Config.HostAgent.plugins.hostsvc.esxAdminsGroup|Syslog.global.logDir"}
+        {
+            $advancedSettings = $null
+        }
+    }
+
+    if ($null -ne $advancedSettings)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found Advanced Setting: {0}" -f $advancedSettings)
+        return $advancedSettings
+    }
+    else
+    {
+        return $null
+    }
+}
+
+function Get-OrganizationValueTestString
+{
+    [CmdletBinding()]
+    [OutputType([string])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [string]
+        $Id
+    )
+
+    switch ($Id)
+    {
+        {$PsItem -match 'V-93955'}
+        {
+            return '{0} is set to "Syslog.global.logHost" = "site specific log host"'
+        }
+        {$PsItem -match 'V-94037'}
+        {
+            return '"{0}" is set to "Syslog.global.logDir" = "site specific log storage location"'
+        }
+        default
+        {
+            return $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VsphereAdvancedSettings/Convert/VsphereAdvancedSettingsRule.Convert.psm1 b/source/Module/Rule.VsphereAdvancedSettings/Convert/VsphereAdvancedSettingsRule.Convert.psm1
new file mode 100644
index 000000000..273b50780
--- /dev/null
+++ b/source/Module/Rule.VsphereAdvancedSettings/Convert/VsphereAdvancedSettingsRule.Convert.psm1
@@ -0,0 +1,124 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VsphereAdvancedSettingsRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+# Header
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a Vsphere object
+    .DESCRIPTION
+        The VsphereAdvancedSettingsRule class is used to extract the Vsphere settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        Vsphere AdvancedSettings rule, it is passed to the VsphereRule class for parsing
+        and validation.
+#>
+class VsphereAdvancedSettingsRuleConvert : VsphereAdvancedSettingsRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory
+    #>
+    VsphereAdvancedSettingsRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Rule
+        .PARAMETER XccdfRule
+            The STIG rule to convert
+    #>
+    VsphereAdvancedSettingsRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        $fixText = [VsphereAdvancedSettingsRule]::GetFixText($XccdfRule)
+        $this.SetVsphereAdvancedSettings($fixText)
+
+        if ($this.IsOrganizationalSetting())
+        {
+            $this.SetOrganizationValueTestString()
+        }
+
+        $this.SetDscResource()
+    }
+
+    # Methods
+    <#
+    .SYNOPSIS
+        Extracts the advanced settings key value pair from the check-content and sets the Advanced Setting
+    .DESCRIPTION
+        Gets the key value pair from the xccdf content and combines the two as a string.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereAdvancedSettings ([string[]] $fixText)
+    {
+        $vsphereAdvancedSettings = Get-VsphereAdvancedSettings -FixText $fixText -CheckContent $this.RawString
+        $this.set_AdvancedSettings($vsphereAdvancedSettings)
+    }
+
+    <#
+    .SYNOPSIS
+        Tests if and organizational value is required
+    .DESCRIPTION
+        Tests if and organizational value is required
+    #>
+    [bool] IsOrganizationalSetting ()
+    {
+        if ($this.id -match 'V-93955|V-94025|V-94509|V-94533|V-94037')
+        {
+            return $true
+        }
+        else
+        {
+            return $false
+        }
+    }
+
+    <#
+    .SYNOPSIS
+        Set the organizational value
+    .DESCRIPTION
+        Extracts the organizational value from the key and then sets the value
+    #>
+    [void] SetOrganizationValueTestString ()
+    {
+        $OrganizationValueTestString = Get-OrganizationValueTestString -Id $this.Id
+
+        if (-not $this.SetStatus($OrganizationValueTestString))
+        {
+            $this.set_OrganizationValueTestString($OrganizationValueTestString)
+            $this.set_OrganizationValueRequired($true)
+        }
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostAdvancedSettings'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'Get-AdvancedSetting')
+        {
+            return $true
+        }
+
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VsphereAdvancedSettings/VsphereAdvancedSettingsRule.psm1 b/source/Module/Rule.VsphereAdvancedSettings/VsphereAdvancedSettingsRule.psm1
new file mode 100644
index 000000000..2dd618929
--- /dev/null
+++ b/source/Module/Rule.VsphereAdvancedSettings/VsphereAdvancedSettingsRule.psm1
@@ -0,0 +1,60 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+#header
+
+<#
+    .SYNOPSIS
+        An Vsphere Advanced Settings Rule object.
+    .DESCRIPTION
+        The Vsphere Advanced Settings class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER AdvancedSettings
+        A string with value name and value data. (i.e. 'ValueName' = 'ValueData').
+#>
+class VsphereAdvancedSettingsRule : Rule
+{
+    [string] $AdvancedSettings <#(ExceptionValue)#>
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method.
+    #>
+    VsphereAdvancedSettingsRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory.
+        .PARAMETER Rule
+            The STIG rule to load.
+    #>
+    VsphereAdvancedSettingsRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor.
+        .PARAMETER Rule
+            The STIG rule to convert.
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature.
+    #>
+    VsphereAdvancedSettingsRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content.
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VsphereKernelActiveDumpPartition/Convert/Methods.ps1 b/source/Module/Rule.VsphereKernelActiveDumpPartition/Convert/Methods.ps1
new file mode 100644
index 000000000..0f2703429
--- /dev/null
+++ b/source/Module/Rule.VsphereKernelActiveDumpPartition/Convert/Methods.ps1
@@ -0,0 +1,37 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        Takes the Rawstring from the fix text of a VsphereKernelActiveDumpPartitionRule.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the Fix text of the STIG.
+#>
+function Get-VsphereKernelActiveDumpPartition
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'coredump.partition')
+    {
+        $kernelActiveDumpPartitionEnabled = ($FixText | Select-String -Pattern '(?<=coredump.network.set\()(.\w+)(?=\))').Matches.Value
+    }
+
+    if ($null -ne $kernelActiveDumpPartitionEnabled)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found Host Kernel Active Dump Partition Enabled: {0}" -f $kernelActiveDumpPartitionEnabled)
+        return $kernelActiveDumpPartitionEnabled
+    }
+    else
+    {
+        return $null
+    }
+}
diff --git a/source/Module/Rule.VsphereKernelActiveDumpPartition/Convert/VsphereKernelActiveDumpPartitionRule.Convert.psm1 b/source/Module/Rule.VsphereKernelActiveDumpPartition/Convert/VsphereKernelActiveDumpPartitionRule.Convert.psm1
new file mode 100644
index 000000000..47ba21eb2
--- /dev/null
+++ b/source/Module/Rule.VsphereKernelActiveDumpPartition/Convert/VsphereKernelActiveDumpPartitionRule.Convert.psm1
@@ -0,0 +1,82 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VsphereKernelActiveDumpPartitionRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose -Message "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a Vsphere object.
+    .DESCRIPTION
+        The VsphereRule class is used to extract the Vsphere settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        Vsphere rule, it is passed to the VsphereRule class for parsing
+        and validation.
+#>
+class VsphereKernelActiveDumpPartitionRuleConvert : VsphereKernelActiveDumpPartitionRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory.
+    #>
+    VsphereKernelActiveDumpPartitionRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Kernel Active Dump Partition Rule.
+        .PARAMETER XccdfRule
+            The STIG rule to convert.
+    #>
+    VsphereKernelActiveDumpPartitionRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        $fixText = [VsphereKernelActiveDumpPartitionRule]::GetFixText($XccdfRule)
+        $this.SetVsphereKernelActiveDumpPartition($fixText)
+        $this.SetDscResource()
+    }
+
+    # Methods
+    <#
+    .SYNOPSIS
+        Extracts the Kernel Active Dump Partition boolean from the fix text and sets the value.
+    .DESCRIPTION
+        Gets the boolean from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereKernelActiveDumpPartition ([string[]] $fixText)
+    {
+        $vsphereKernelActiveDumpPartition = Get-VsphereKernelActiveDumpPartition -FixText $fixText
+        $this.set_Enabled($vsphereKernelActiveDumpPartition)
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostKernelActiveDumpPartition'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'coredump.partition')
+        {
+            return $true
+        }
+
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VsphereKernelActiveDumpPartition/VsphereKernelActiveDumpPartitionRule.psm1 b/source/Module/Rule.VsphereKernelActiveDumpPartition/VsphereKernelActiveDumpPartitionRule.psm1
new file mode 100644
index 000000000..55b62bd81
--- /dev/null
+++ b/source/Module/Rule.VsphereKernelActiveDumpPartition/VsphereKernelActiveDumpPartitionRule.psm1
@@ -0,0 +1,60 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+#header
+
+<#
+    .SYNOPSIS
+        An Vsphere Rule object
+    .DESCRIPTION
+        The Vsphere Kernel ActiveDump Partition class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER Enabled
+        The boolean $true or $false to enable or disable this feature.
+#>
+class VsphereKernelActiveDumpPartitionRule : Rule
+{
+    [string] $Enabled
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method
+    #>
+    VsphereKernelActiveDumpPartitionRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory
+        .PARAMETER Rule
+            The STIG rule to load
+    #>
+    VsphereKernelActiveDumpPartitionRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor
+        .PARAMETER Rule
+            The STIG rule to convert
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature
+    #>
+    VsphereKernelActiveDumpPartitionRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VsphereNtpSettings/Convert/Methods.ps1 b/source/Module/Rule.VsphereNtpSettings/Convert/Methods.ps1
new file mode 100644
index 000000000..d55374424
--- /dev/null
+++ b/source/Module/Rule.VsphereNtpSettings/Convert/Methods.ps1
@@ -0,0 +1,62 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        This returns null for the value of a Vsphere Ntp SettingsRule, because the ony rule
+        is an organizational setting.
+
+    .PARAMETER CheckContent
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereNtpSettings
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $CheckContent
+    )
+
+    if ($CheckContent -match 'Get-VMHostNTPServer')
+    {
+        $ntpServer = $null
+    }
+
+    if ($null -ne $ntpServer)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] NTPServer List Found: {0}" -f $ntpServer)
+        return $ntpServer
+    }
+    else
+    {
+        return $null
+    }
+}
+
+<#
+    .SYNOPSIS
+        This returns the organizational test string from a Vsphere Ntp SettingsRule.
+
+    .PARAMETER Id
+        This is the id of the rule that matches the organizational test string.
+#>
+function Get-VsphereNtpSettingsOrganizationValueTestString
+{
+    [CmdletBinding()]
+    [OutputType([string])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [string]
+        $Id
+    )
+
+    if ($this.id -match "V-94039")
+    {
+        return '{0} is set to a string array of authoritative DoD time sources'
+    }
+}
diff --git a/source/Module/Rule.VsphereNtpSettings/Convert/VsphereNtpSettingsRule.Convert.psm1 b/source/Module/Rule.VsphereNtpSettings/Convert/VsphereNtpSettingsRule.Convert.psm1
new file mode 100644
index 000000000..2e787b386
--- /dev/null
+++ b/source/Module/Rule.VsphereNtpSettings/Convert/VsphereNtpSettingsRule.Convert.psm1
@@ -0,0 +1,119 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VsphereNtpSettingsRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose -Message "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a Vsphere Ntp Settings object.
+    .DESCRIPTION
+        The Vsphere Ntp Settings Rule class is used to extract the Vsphere Ntp settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        Vsphere Ntp Settings rule, it is passed to the Vsphere Ntp Settings Rule class for parsing
+        and validation.
+#>
+class VsphereNtpSettingsRuleConvert : VsphereNtpSettingsRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory.
+    #>
+    VsphereNtpSettingsRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Rule.
+        .PARAMETER XccdfRule
+            The STIG rule to convert.
+    #>
+    VsphereNtpSettingsRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        if ($this.IsOrganizationalSetting())
+        {
+            $this.SetOrganizationValueTestString()
+        }
+
+        $this.SetVsphereNtpSettings()
+        $this.SetDscResource()
+    }
+
+    <#
+        .SYNOPSIS
+            Tests if and organizational value is required.
+        .DESCRIPTION
+            Tests if and organizational value is required.
+    #>
+    [bool] IsOrganizationalSetting ()
+    {
+        if ([String]::IsNullOrEmpty($this.NtpServer))
+        {
+            return $true
+        }
+        else
+        {
+            return $false
+        }
+    }
+
+    <#
+    .SYNOPSIS
+        Set the organizational value.
+    .DESCRIPTION
+        Extracts the organizational value from the key and then sets the value.
+    #>
+    [void] SetOrganizationValueTestString ()
+    {
+        $OrganizationValueTestString = Get-VsphereNtpSettingsOrganizationValueTestString -Id $this.id
+
+        if (-not $this.SetStatus($OrganizationValueTestString))
+        {
+            $this.set_OrganizationValueTestString($OrganizationValueTestString)
+            $this.set_OrganizationValueRequired($true)
+        }
+    }
+
+    <#
+        .SYNOPSIS
+            Extracts the Vsphere NTP settings from the check-content and sets the value.
+        .DESCRIPTION
+            Gets the NTP server list from the xccdf content and sets the value.
+            If the value that is returned is not valid, the parser status is
+            set to fail.
+    #>
+    [void] SetVsphereNtpSettings ()
+    {
+        $vsphereNtpSettings = Get-VsphereNtpSettings -CheckContent $this.SplitCheckContent
+        $this.set_NtpServer($vsphereNtpSettings)
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostNtpSettings'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'Get-VMHostNTPServer')
+        {
+            return $true
+        }
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VsphereNtpSettings/VsphereNtpSettingsRule.psm1 b/source/Module/Rule.VsphereNtpSettings/VsphereNtpSettingsRule.psm1
new file mode 100644
index 000000000..0aff6921e
--- /dev/null
+++ b/source/Module/Rule.VsphereNtpSettings/VsphereNtpSettingsRule.psm1
@@ -0,0 +1,60 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+#header
+
+<#
+    .SYNOPSIS
+        An Vsphere NTP Settings Rule object
+    .DESCRIPTION
+        The Vsphere class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER NtpServer
+        The string array of NTP servers used by the host.
+#>
+class VsphereNtpSettingsRule : Rule
+{
+    [string[]] $NtpServer
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method
+    #>
+    VsphereNtpSettingsRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory
+        .PARAMETER Rule
+            The STIG rule to load
+    #>
+    VsphereNtpSettingsRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor
+        .PARAMETER Rule
+            The STIG rule to convert
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature
+    #>
+    VsphereNtpSettingsRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VspherePortGroupSecurity/Convert/Methods.ps1 b/source/Module/Rule.VspherePortGroupSecurity/Convert/Methods.ps1
new file mode 100644
index 000000000..992193253
--- /dev/null
+++ b/source/Module/Rule.VspherePortGroupSecurity/Convert/Methods.ps1
@@ -0,0 +1,105 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        This function parses the fix text to find the boolean value of ForgedTransmitsInherited, then sets the value.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereForgedTransmitsInherited
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'Get-VirtualPortGroup')
+    {
+        $vsphereForgedTransmitsInherited = ($FixText | Select-String -Pattern '(?<=ForgedTransmitsInherited\s)(.\w+)').Matches.Value
+    }
+
+    if ($null -ne $vsphereForgedTransmitsInherited)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found ForgedTransmitsInherited value: {0}" -f $vsphereForgedTransmitsInherited)
+        return $vsphereForgedTransmitsInherited
+    }
+    else
+    {
+        return $null
+    }
+}
+
+<#
+    .SYNOPSIS
+        This function parses the fix text to find the boolean value of MacChangesInherited, then sets the value.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereMacChangeInherited
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'Get-VirtualPortGroup')
+    {
+        $vsphereMacChangeInherited = ($FixText | Select-String -Pattern '(?<=MacChangesInherited\s)(.\w+)').Matches.Value
+    }
+
+    if ($null -ne $vsphereMacChangeInherited)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found MacChangesInherited value: {0}" -f $vsphereMacChangeInherited)
+        return $vsphereMacChangeInherited
+    }
+    else
+    {
+        return $null
+    }
+}
+
+<#
+    .SYNOPSIS
+        This function parses the fix text to find the boolean value of AllowPromiscuousInherited, then sets the value.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereAllowPromiscuousInherited
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'Get-VirtualPortGroup')
+    {
+        $vsphereAllowPromiscuousInherited = ($FixText | Select-String -Pattern '(?<=AllowPromiscuousInherited\s)(.\w+)').Matches.Value
+    }
+
+    if ($null -ne $vsphereAllowPromiscuousInherited)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found AllowPromiscuousInherited value: {0}" -f $vsphereAllowPromiscuousInherited)
+        return $vsphereAllowPromiscuousInherited
+    }
+    else
+    {
+        return $null
+    }
+}
diff --git a/source/Module/Rule.VspherePortGroupSecurity/Convert/VspherePortGroupSecurityRule.Convert.psm1 b/source/Module/Rule.VspherePortGroupSecurity/Convert/VspherePortGroupSecurityRule.Convert.psm1
new file mode 100644
index 000000000..1b86b52a9
--- /dev/null
+++ b/source/Module/Rule.VspherePortGroupSecurity/Convert/VspherePortGroupSecurityRule.Convert.psm1
@@ -0,0 +1,121 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VspherePortGroupSecurityRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose -Message "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a Vsphere Port Group Security Rule object.
+    .DESCRIPTION
+        The VspherePortGroupSecurityRule class is used to extract the Vsphere Port Group Security settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        VspherePortGroupSecurity rule, it is passed to the VspherePortGroupSecurityRule class for parsing
+        and validation.
+#>
+class VspherePortGroupSecurityRuleConvert : VspherePortGroupSecurityRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory.
+    #>
+    VspherePortGroupSecurityRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Rule.
+        .PARAMETER XccdfRule
+            The STIG rule to convert.
+    #>
+    VspherePortGroupSecurityRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        $fixText = [VspherePortGroupSecurityRule]::GetFixText($XccdfRule)
+        $this.SetVsphereForgedTransmitsInherited($fixText)
+        $this.SetVsphereMacChangesInherited($fixText)
+        $this.SetVsphereAllowPromiscuousInherited($fixText)
+        $this.SetDscResource()
+    }
+
+    # Methods
+    <#
+    .SYNOPSIS
+        Extracts the ForgedTransmitInherited boolean from the fix text and sets the value.
+    .DESCRIPTION
+        Gets the boolean from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereForgedTransmitsInherited([string[]] $fixText)
+    {
+        $vsphereForgedTransmitsInherited = Get-VsphereForgedTransmitsInherited -FixText $fixText
+        if (-not [String]::IsNullOrEmpty($vsphereForgedTransmitsInherited))
+        {
+            $this.set_ForgedTransmitsInherited($vsphereForgedTransmitsInherited)
+        }
+    }
+
+    <#
+    .SYNOPSIS
+        Extracts the MacChangesInherited boolean from the fix text and sets the value.
+    .DESCRIPTION
+        Gets the boolean from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereMacChangesInherited([string[]] $fixText)
+    {
+        $vsphereMacChangeInherited = Get-VsphereMacChangeInherited -FixText $fixText
+        if (-not [String]::IsNullOrEmpty($vsphereMacChangeInherited))
+        {
+            $this.set_MacChangesInherited($vsphereMacChangeInherited)
+        }
+    }
+
+    <#
+    .SYNOPSIS
+        Extracts the AllowPromiscuousInherited boolean from the fix text and sets the value.
+    .DESCRIPTION
+        Gets the boolean from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereAllowPromiscuousInherited([string[]] $fixText)
+    {
+        $vsphereAllowPromiscuousInherited = Get-VsphereAllowPromiscuousInherited -FixText $fixText
+        if (-not [String]::IsNullOrEmpty($vsphereAllowPromiscuousInherited))
+        {
+            $this.set_AllowPromiscuousInherited($vsphereAllowPromiscuousInherited)
+        }
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostVssPortGroupSecurity'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'Get-VirtualPortGroup')
+        {
+            return $true
+        }
+
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VspherePortGroupSecurity/VspherePortGroupSecurityRule.psm1 b/source/Module/Rule.VspherePortGroupSecurity/VspherePortGroupSecurityRule.psm1
new file mode 100644
index 000000000..1487003ce
--- /dev/null
+++ b/source/Module/Rule.VspherePortGroupSecurity/VspherePortGroupSecurityRule.psm1
@@ -0,0 +1,67 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+#header
+
+<#
+    .SYNOPSIS
+        An Vsphere Rule object
+    .DESCRIPTION
+        The Vsphere class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER ForgedTransmitsInherited
+        The boolean answer to allowing forged transmits on port groups nherited from switch configuration
+    .PARAMETER MacChangesInherited
+                The boolean answer to allowing Mac Changes on port groups inherited from switch configuration
+    .PARAMETER AllowPromiscuousInherited
+                The boolean answer to allowing Promiscuous mode on port groups inherited from switch configuration
+
+#>
+class VspherePortGroupSecurityRule : Rule
+{
+    [string] $ForgedTransmitsInherited
+    [string] $MacChangesInherited
+    [string] $AllowPromiscuousInherited
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method
+    #>
+    VspherePortGroupSecurityRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory
+        .PARAMETER Rule
+            The STIG rule to load
+    #>
+    VspherePortGroupSecurityRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor
+        .PARAMETER Rule
+            The STIG rule to convert
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature
+    #>
+    VspherePortGroupSecurityRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VsphereService/Convert/Methods.ps1 b/source/Module/Rule.VsphereService/Convert/Methods.ps1
new file mode 100644
index 000000000..556743cc4
--- /dev/null
+++ b/source/Module/Rule.VsphereService/Convert/Methods.ps1
@@ -0,0 +1,98 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        Finds the Key property from a VsphereServiceRule.
+
+    .PARAMETER CheckContent
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereServiceKey
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $CheckContent
+    )
+
+    if ($CheckContent -match 'Get-VMHostService')
+    {
+        $name = ($CheckContent | Select-String -Pattern '(?<=Label -eq ")([^"]*)' -AllMatches).Matches.Value
+    }
+
+    switch ($name)
+    {
+        {$PSItem -match "NTP Daemon"}
+        {
+            $key = 'ntpd'
+        }
+        {$PSItem -match "ESXi Shell"}
+        {
+            $key = 'TSM'
+        }
+        {$PSItem -match "SSH"}
+        {
+            $key = 'TSM-SSH'
+        }
+    }
+
+    if ($null -ne $key)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found Key name: {0}" -f $key)
+        return $key
+    }
+    else
+    {
+        return $null
+    }
+}
+
+<#
+    .SYNOPSIS
+        Gets the startup policy and running status from a vsphere service rule.
+
+    .PARAMETER CheckContent
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereServicePolicy
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $CheckContent
+    )
+
+    if ($CheckContent -match 'Get-VMHostService')
+    {
+        $servicePolicy = ($CheckContent | Select-String -Pattern '(?<=verify it is )(\w+)' -AllMatches).Matches.Value
+
+        if ($servicePolicy -eq "stopped")
+        {
+            $policy = "off"
+            $running = $false
+        }
+        else
+        {
+            $policy = "Automatic"
+            $running = $true
+        }
+    }
+
+    if ($null -ne $policy)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found Service Policy: {0}" -f $policy)
+        return $policy,$running
+    }
+    else
+    {
+        return $null
+    }
+}
diff --git a/source/Module/Rule.VsphereService/Convert/VsphereServiceRule.Convert.psm1 b/source/Module/Rule.VsphereService/Convert/VsphereServiceRule.Convert.psm1
new file mode 100644
index 000000000..ce674e14e
--- /dev/null
+++ b/source/Module/Rule.VsphereService/Convert/VsphereServiceRule.Convert.psm1
@@ -0,0 +1,96 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VsphereServiceRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+# Header
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a VsphereServiceRule object
+    .DESCRIPTION
+        The VsphereServiceRule class is used to extract the Vsphere Service settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        Vsphere Service rule, it is passed to the VsphereServiceRule class for parsing
+        and validation.
+#>
+class VsphereServiceRuleConvert : VsphereServiceRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory
+    #>
+    VsphereServiceRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Rule
+        .PARAMETER XccdfRule
+            The STIG rule to convert
+    #>
+    VsphereServiceRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        $this.SetKey()
+        $this.SetPolicy()
+        $this.SetDscResource()
+    }
+
+    # Methods
+    <#
+    .SYNOPSIS
+        Extracts the Key (serviceName) from the check-content and sets the values
+    .DESCRIPTION
+        Gets the key from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetKey ()
+    {
+        $key = Get-VsphereServiceKey -CheckContent $this.SplitCheckContent
+        $this.set_Key($key)
+    }
+
+    <#
+    .SYNOPSIS
+        Extracts the service policy from the check-content and sets the values of policy and running state
+    .DESCRIPTION
+        Gets the policy from the check-content then sets both the policy and running state based on match.
+    #>
+    [void] SetPolicy ()
+    {
+        $policy = Get-VsphereServicePolicy -CheckContent $this.SplitCheckContent
+        $this.set_Policy($policy[0])
+        $this.set_Running($policy[1])
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostService'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'Get-VMHostService')
+        {
+            return $true
+        }
+
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VsphereService/VsphereServiceRule.psm1 b/source/Module/Rule.VsphereService/VsphereServiceRule.psm1
new file mode 100644
index 000000000..801dd205b
--- /dev/null
+++ b/source/Module/Rule.VsphereService/VsphereServiceRule.psm1
@@ -0,0 +1,66 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+#header
+
+<#
+    .SYNOPSIS
+        An Vsphere Rule object
+    .DESCRIPTION
+        The Vsphere class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER Key
+        The name of the Vsphere service.
+    .PARAMETER Policy
+        The startup policy of the Vsphere service.
+    .PARAMETER Running
+        The running state of the Vsphere service.
+#>
+class VsphereServiceRule : Rule
+{
+    [string] $Key
+    [string] $Policy
+    [bool] $Running
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method
+    #>
+    VsphereServiceRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory
+        .PARAMETER Rule
+            The STIG rule to load
+    #>
+    VsphereServiceRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor
+        .PARAMETER Rule
+            The STIG rule to convert
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature
+    #>
+    VsphereServiceRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VsphereSnmpAgent/Convert/Methods.ps1 b/source/Module/Rule.VsphereSnmpAgent/Convert/Methods.ps1
new file mode 100644
index 000000000..75bfbf35a
--- /dev/null
+++ b/source/Module/Rule.VsphereSnmpAgent/Convert/Methods.ps1
@@ -0,0 +1,37 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        Gets the boolean SNMPAgent Enabled property from a VsphereSnmpAgentRule.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereSnmpAgent
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'Get-VMHostSnmp')
+    {
+        $snmpAgent = ($FixText | Select-String -Pattern '(?<=Set-VMHostSnmp -Enabled\s)(.\w+)').Matches.Value
+    }
+
+    if ($null -ne $snmpAgent)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found Host SNMP Enabled: {0}" -f $snmpAgent)
+        return $snmpAgent
+    }
+    else
+    {
+        return $null
+    }
+}
diff --git a/source/Module/Rule.VsphereSnmpAgent/Convert/VsphereSnmpAgentRule.Convert.psm1 b/source/Module/Rule.VsphereSnmpAgent/Convert/VsphereSnmpAgentRule.Convert.psm1
new file mode 100644
index 000000000..88efeb5cc
--- /dev/null
+++ b/source/Module/Rule.VsphereSnmpAgent/Convert/VsphereSnmpAgentRule.Convert.psm1
@@ -0,0 +1,83 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VsphereSnmpAgentRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+# Header
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a Vsphere object
+    .DESCRIPTION
+        The VsphereRule class is used to extract the Vsphere settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        Vsphere rule, it is passed to the VsphereRule class for parsing
+        and validation.
+#>
+class VsphereSnmpAgentRuleConvert : VsphereSnmpAgentRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory
+    #>
+    VsphereSnmpAgentRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Rule
+        .PARAMETER XccdfRule
+            The STIG rule to convert
+    #>
+    VsphereSnmpAgentRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        $fixText = [VsphereSnmpAgentRule]::GetFixText($XccdfRule)
+        $this.SetVsphereSnmpAgent($fixText)
+        $this.SetDscResource()
+    }
+
+    # Methods
+    <#
+    .SYNOPSIS
+        Extracts the Snmp Agent boolean from the check-content and sets the values
+    .DESCRIPTION
+        Gets the bollean from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereSnmpAgent ([string[]] $fixText)
+    {
+        $vsphereSnmpAgent = Get-VsphereSnmpAgent -FixText $fixText
+        $this.set_Enabled($vsphereSnmpAgent)
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostSnmpAgent'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'Get-VMHostSnmp')
+        {
+            return $true
+        }
+
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VsphereSnmpAgent/VsphereSnmpAgentRule.psm1 b/source/Module/Rule.VsphereSnmpAgent/VsphereSnmpAgentRule.psm1
new file mode 100644
index 000000000..fe4513d3c
--- /dev/null
+++ b/source/Module/Rule.VsphereSnmpAgent/VsphereSnmpAgentRule.psm1
@@ -0,0 +1,60 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+#header
+
+<#
+    .SYNOPSIS
+        An Vsphere Rule object
+    .DESCRIPTION
+        The Vsphere class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER Enabled
+        The boolean $true or $false to enable or disable this feature.
+#>
+class VsphereSnmpAgentRule : Rule
+{
+    [string] $Enabled
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method
+    #>
+    VsphereSnmpAgentRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory
+        .PARAMETER Rule
+            The STIG rule to load
+    #>
+    VsphereSnmpAgentRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor
+        .PARAMETER Rule
+            The STIG rule to convert
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature
+    #>
+    VsphereSnmpAgentRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/source/Module/Rule.VsphereVssSecurity/Convert/Methods.ps1 b/source/Module/Rule.VsphereVssSecurity/Convert/Methods.ps1
new file mode 100644
index 000000000..d442ee472
--- /dev/null
+++ b/source/Module/Rule.VsphereVssSecurity/Convert/Methods.ps1
@@ -0,0 +1,103 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#region Method Functions
+
+<#
+    .SYNOPSIS
+        This function parses the fix text to find the boolean value of ForgedTransmits, then sets the value.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereForgedTransmits
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'Get-VirtualSwitch')
+    {
+        $vsphereForgedTransmits = ($FixText | Select-String -Pattern '(?<=ForgedTransmits\s)(.\w+)').Matches.Value
+    }
+
+    if ($null -ne $vsphereForgedTransmits)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found ForgedTransmits value: {0}" -f $vsphereForgedTransmits)
+        return $vsphereForgedTransmits
+    }
+    else
+    {
+        return $null
+    }
+}
+<#
+    .SYNOPSIS
+        This function parses the fix text to find the boolean value of MacChanges, then sets the value.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereMacChange
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'Get-VirtualSwitch')
+    {
+        $vsphereMacChange = ($FixText | Select-String -Pattern '(?<=MacChanges\s)(.\w+)').Matches.Value
+    }
+
+    if ($null -ne $vsphereMacChange)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found MacChanges value: {0}" -f $vsphereMacChange)
+        return $vsphereMacChange
+    }
+    else
+    {
+        return $null
+    }
+}
+<#
+    .SYNOPSIS
+        This function parses the fix text to find the boolean value of AllowPromiscuous, then sets the value.
+
+    .PARAMETER RawString
+        An array of the raw string data taken from the STIG setting.
+#>
+function Get-VsphereAllowPromiscuous
+{
+    [CmdletBinding()]
+    [OutputType([object])]
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [psobject]
+        $FixText
+    )
+
+    if ($FixText -match 'Get-VirtualSwitch')
+    {
+        $vsphereAllowPromiscuous = ($FixText | Select-String -Pattern '(?<=AllowPromiscuous\s)(.\w+)').Matches.Value
+    }
+
+    if ($null -ne $vsphereAllowPromiscuous)
+    {
+        Write-Verbose -Message $("[$($MyInvocation.MyCommand.Name)] Found AllowPromiscuous value: {0}" -f $vsphereAllowPromiscuous)
+        return $vsphereAllowPromiscuous
+    }
+    else
+    {
+        return $null
+    }
+}
diff --git a/source/Module/Rule.VsphereVssSecurity/Convert/VsphereVssSecurityRule.Convert.psm1 b/source/Module/Rule.VsphereVssSecurity/Convert/VsphereVssSecurityRule.Convert.psm1
new file mode 100644
index 000000000..c35ec765f
--- /dev/null
+++ b/source/Module/Rule.VsphereVssSecurity/Convert/VsphereVssSecurityRule.Convert.psm1
@@ -0,0 +1,122 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\..\Common\Common.psm1
+using module .\..\VsphereVssSecurityRule.psm1
+
+$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt')
+$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude
+foreach ($supportFile in $supportFileList)
+{
+    Write-Verbose "Loading $($supportFile.FullName)"
+    . $supportFile.FullName
+}
+# Header
+
+<#
+    .SYNOPSIS
+        Convert the contents of an xccdf check-content element into a Vsphere Vss Security Rule object
+    .DESCRIPTION
+        The VsphereVssSecurityRule class is used to extract the VsphereVssSecurityRule settings
+        from the check-content of the xccdf. Once a STIG rule is identified a
+        VsphereVssSecurity rule, it is passed to the VsphereVssSecurityRule class for parsing
+        and validation.
+#>
+class VsphereVssSecurityRuleConvert : VsphereVssSecurityRule
+{
+    <#
+        .SYNOPSIS
+            Empty constructor for SplitFactory
+    #>
+    VsphereVssSecurityRuleConvert ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Converts an xccdf stig rule element into a Vsphere Rule
+        .PARAMETER XccdfRule
+            The STIG rule to convert
+    #>
+    VsphereVssSecurityRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
+    {
+        $fixText = [VsphereVssSecurityRule]::GetFixText($XccdfRule)
+        $this.SetVsphereForgedTransmits($fixText)
+        $this.SetVsphereMacChanges($fixText)
+        $this.SetVsphereAllowPromiscuous($fixText)
+        $this.SetDscResource()
+    }
+
+    # Methods
+    <#
+    .SYNOPSIS
+        Extracts the Vsphere ForgedTransmits settings from the fix text and sets the value
+    .DESCRIPTION
+        Gets the ForgedTransmits from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereForgedTransmits([string[]] $fixText)
+    {
+        $vsphereForgedTransmits = Get-VsphereForgedTransmits -FixText $fixText
+        if (-not [String]::IsNullOrEmpty($vsphereForgedTransmits))
+        {
+            $this.set_ForgedTransmits($vsphereForgedTransmits)
+        }
+    }
+
+    <#
+    .SYNOPSIS
+        Extracts the Vsphere MacChanges settings from the fix text and sets the value
+    .DESCRIPTION
+        Gets the MacChanges from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereMacChanges([string[]] $fixText)
+    {
+        $vsphereMacChange = Get-VsphereMacChange -FixText $fixText
+        if (-not [String]::IsNullOrEmpty($vsphereMacChange))
+        {
+            $this.set_MacChanges($vsphereMacChange)
+        }
+    }
+
+    <#
+    .SYNOPSIS
+        Extracts the Vsphere AllowPromiscuous settings from the fix text and sets the value
+    .DESCRIPTION
+        Gets the AllowPromiscuous from the xccdf content and sets the value.
+        If the value that is returned is not valid, the parser status is
+        set to fail.
+    #>
+    [void] SetVsphereAllowPromiscuous([string[]] $fixText)
+    {
+        $vsphereAllowPromiscuous = Get-VsphereAllowPromiscuous -FixText $fixText
+        if (-not [String]::IsNullOrEmpty($vsphereAllowPromiscuous))
+        {
+            $this.set_AllowPromiscuous($vsphereAllowPromiscuous)
+        }
+    }
+
+    hidden [void] SetDscResource ()
+    {
+        if ($null -eq $this.DuplicateOf)
+        {
+            $this.DscResource = 'VMHostVssSecurity'
+        }
+        else
+        {
+            $this.DscResource = 'None'
+        }
+    }
+
+    static [bool] Match ([string] $CheckContent)
+    {
+        if ($CheckContent -match 'Get-VirtualSwitch')
+        {
+            return $true
+        }
+
+        return $false
+    }
+}
diff --git a/source/Module/Rule.VsphereVssSecurity/VsphereVssSecurityRule.psm1 b/source/Module/Rule.VsphereVssSecurity/VsphereVssSecurityRule.psm1
new file mode 100644
index 000000000..3ef6e1bd5
--- /dev/null
+++ b/source/Module/Rule.VsphereVssSecurity/VsphereVssSecurityRule.psm1
@@ -0,0 +1,66 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+using module .\..\Common\Common.psm1
+using module .\..\Rule\Rule.psm1
+#header
+
+<#
+    .SYNOPSIS
+        An Vsphere Rule object
+    .DESCRIPTION
+        The Vsphere class is used to maange the Vmware Vsphere Settings.
+    .PARAMETER ForgedTransmits
+        The boolean answer to allowing forged transmits on the switch configuration
+    .PARAMETER MacChanges
+        The boolean answer to allowing Mac Changes on the switch configuration
+    .PARAMETER AllowPromiscuous
+        The boolean answer to allowing Promiscuous mode on the switch configuration
+#>
+class VsphereVssSecurityRule : Rule
+{
+    [string] $ForgedTransmits
+    [string] $MacChanges
+    [string] $AllowPromiscuous
+
+    <#
+        .SYNOPSIS
+            Default constructor to support the AsRule cast method
+    #>
+    VsphereVssSecurityRule ()
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Used to load PowerSTIG data from the processed data directory
+        .PARAMETER Rule
+            The STIG rule to load
+    #>
+    VsphereVssSecurityRule ([xml.xmlelement] $Rule) : base ($Rule)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            The Convert child class constructor
+        .PARAMETER Rule
+            The STIG rule to convert
+        .PARAMETER Convert
+            A simple bool flag to create a unique constructor signature
+    #>
+    VsphereVssSecurityRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
+    {
+    }
+
+    <#
+        .SYNOPSIS
+            Creates class specifc help content
+    #>
+    [hashtable] GetExceptionHelp()
+    {
+        return @{
+            Value = "15"
+            Notes = $null
+        }
+    }
+}
diff --git a/Module/Rule.WebAppPool/Convert/Methods.ps1 b/source/Module/Rule.WebAppPool/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.WebAppPool/Convert/Methods.ps1
rename to source/Module/Rule.WebAppPool/Convert/Methods.ps1
diff --git a/Module/Rule.WebAppPool/Convert/WebAppPoolRule.Convert.psm1 b/source/Module/Rule.WebAppPool/Convert/WebAppPoolRule.Convert.psm1
similarity index 95%
rename from Module/Rule.WebAppPool/Convert/WebAppPoolRule.Convert.psm1
rename to source/Module/Rule.WebAppPool/Convert/WebAppPoolRule.Convert.psm1
index d5b3b136d..ad1f6cd54 100644
--- a/Module/Rule.WebAppPool/Convert/WebAppPoolRule.Convert.psm1
+++ b/source/Module/Rule.WebAppPool/Convert/WebAppPoolRule.Convert.psm1
@@ -21,7 +21,7 @@ foreach ($supportFile in $supportFileList)
         webapp rule, it is passed to the WebAppPoolRule class for parsing
         and validation.
 #>
-Class WebAppPoolRuleConvert : WebAppPoolRule
+class WebAppPoolRuleConvert : WebAppPoolRule
 {
     <#
         .SYNOPSIS
@@ -37,7 +37,7 @@ Class WebAppPoolRuleConvert : WebAppPoolRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    WebAppPoolRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    WebAppPoolRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetKeyValuePair()
         if ($this.IsOrganizationalSetting())
@@ -110,7 +110,7 @@ Class WebAppPoolRuleConvert : WebAppPoolRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'xWebAppPool'
         }
diff --git a/Module/Rule.WebAppPool/WebAppPoolRule.psm1 b/source/Module/Rule.WebAppPool/WebAppPoolRule.psm1
similarity index 94%
rename from Module/Rule.WebAppPool/WebAppPoolRule.psm1
rename to source/Module/Rule.WebAppPool/WebAppPoolRule.psm1
index 96e2e84a1..d2f77e3ec 100644
--- a/Module/Rule.WebAppPool/WebAppPoolRule.psm1
+++ b/source/Module/Rule.WebAppPool/WebAppPoolRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Value
         The value the web.config key should be set to
 #>
-Class WebAppPoolRule : Rule
+class WebAppPoolRule : Rule
 {
     [string] $Key
     [string] $Value <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class WebAppPoolRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    WebAppPoolRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    WebAppPoolRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class WebAppPoolRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    WebAppPoolRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    WebAppPoolRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.WebConfigurationProperty/Convert/Data.ps1 b/source/Module/Rule.WebConfigurationProperty/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.WebConfigurationProperty/Convert/Data.ps1
rename to source/Module/Rule.WebConfigurationProperty/Convert/Data.ps1
diff --git a/Module/Rule.WebConfigurationProperty/Convert/Methods.ps1 b/source/Module/Rule.WebConfigurationProperty/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.WebConfigurationProperty/Convert/Methods.ps1
rename to source/Module/Rule.WebConfigurationProperty/Convert/Methods.ps1
diff --git a/Module/Rule.WebConfigurationProperty/Convert/WebConfigurationPropertyRule.Convert.psm1 b/source/Module/Rule.WebConfigurationProperty/Convert/WebConfigurationPropertyRule.Convert.psm1
similarity index 95%
rename from Module/Rule.WebConfigurationProperty/Convert/WebConfigurationPropertyRule.Convert.psm1
rename to source/Module/Rule.WebConfigurationProperty/Convert/WebConfigurationPropertyRule.Convert.psm1
index a7eb85622..28ff8b8ae 100644
--- a/Module/Rule.WebConfigurationProperty/Convert/WebConfigurationPropertyRule.Convert.psm1
+++ b/source/Module/Rule.WebConfigurationProperty/Convert/WebConfigurationPropertyRule.Convert.psm1
@@ -22,7 +22,7 @@ foreach ($supportFile in $supportFileList)
         rule is identified as a web configuration property rule, it is passed
         to the WebConfigurationPropertyRule class for parsing and validation.
 #>
-Class WebConfigurationPropertyRuleConvert : WebConfigurationPropertyRule
+class WebConfigurationPropertyRuleConvert : WebConfigurationPropertyRule
 {
     <#
         .SYNOPSIS
@@ -38,7 +38,7 @@ Class WebConfigurationPropertyRuleConvert : WebConfigurationPropertyRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    WebConfigurationPropertyRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    WebConfigurationPropertyRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetConfigSection()
         $this.SetKeyValuePair()
@@ -132,7 +132,7 @@ Class WebConfigurationPropertyRuleConvert : WebConfigurationPropertyRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'xWebConfigKeyValue'
         }
@@ -148,7 +148,7 @@ Class WebConfigurationPropertyRuleConvert : WebConfigurationPropertyRule
         (
             $CheckContent -Match '\.NET Trust Level' -or
             (
-                $CheckContent -Match 'IIS 8\.5 web' -and
+                $CheckContent -Match 'IIS 8\.5 web|IIS 10\.0 web' -and
                 $CheckContent -NotMatch 'document'
             ) -and
             (
@@ -171,7 +171,8 @@ Class WebConfigurationPropertyRuleConvert : WebConfigurationPropertyRule
                 $CheckContent -NotMatch 'Authorization Rules' -and
                 $CheckContent -NotMatch 'regedit <enter>' -and
                 $CheckContent -NotMatch 'Enable proxy' -and
-                $CheckContent -NotMatch 'SSL Settings'
+                $CheckContent -NotMatch 'SSL Settings' -and
+                $CheckContent -NotMatch 'Strict-Transport-Security'
             )
         )
         {
diff --git a/Module/Rule.WebConfigurationProperty/WebConfigurationPropertyRule.psm1 b/source/Module/Rule.WebConfigurationProperty/WebConfigurationPropertyRule.psm1
similarity index 91%
rename from Module/Rule.WebConfigurationProperty/WebConfigurationPropertyRule.psm1
rename to source/Module/Rule.WebConfigurationProperty/WebConfigurationPropertyRule.psm1
index baa14ed4d..381a900df 100644
--- a/Module/Rule.WebConfigurationProperty/WebConfigurationPropertyRule.psm1
+++ b/source/Module/Rule.WebConfigurationProperty/WebConfigurationPropertyRule.psm1
@@ -16,7 +16,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Value
         The value the web.config key should be set to
 #>
-Class WebConfigurationPropertyRule : Rule
+class WebConfigurationPropertyRule : Rule
 {
     [string] $ConfigSection
     [string] $Key
@@ -36,7 +36,7 @@ Class WebConfigurationPropertyRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    WebConfigurationPropertyRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    WebConfigurationPropertyRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -48,7 +48,7 @@ Class WebConfigurationPropertyRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    WebConfigurationPropertyRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    WebConfigurationPropertyRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.WinEventLog/Convert/Data.ps1 b/source/Module/Rule.WinEventLog/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.WinEventLog/Convert/Data.ps1
rename to source/Module/Rule.WinEventLog/Convert/Data.ps1
diff --git a/Module/Rule.WinEventLog/Convert/Methods.ps1 b/source/Module/Rule.WinEventLog/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.WinEventLog/Convert/Methods.ps1
rename to source/Module/Rule.WinEventLog/Convert/Methods.ps1
diff --git a/Module/Rule.WinEventLog/Convert/WinEventLogRule.Convert.psm1 b/source/Module/Rule.WinEventLog/Convert/WinEventLogRule.Convert.psm1
similarity index 95%
rename from Module/Rule.WinEventLog/Convert/WinEventLogRule.Convert.psm1
rename to source/Module/Rule.WinEventLog/Convert/WinEventLogRule.Convert.psm1
index f3c19e582..35fd6448b 100644
--- a/Module/Rule.WinEventLog/Convert/WinEventLogRule.Convert.psm1
+++ b/source/Module/Rule.WinEventLog/Convert/WinEventLogRule.Convert.psm1
@@ -23,7 +23,7 @@ foreach ($supportFile in $supportFileList)
         parsing and validation.
 
 #>
-Class WinEventLogRuleConvert : WinEventLogRule
+class WinEventLogRuleConvert : WinEventLogRule
 {
     <#
         .SYNOPSIS
@@ -39,7 +39,7 @@ Class WinEventLogRuleConvert : WinEventLogRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    WinEventLogRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    WinEventLogRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetWinEventLogName()
         $this.SetWinEventLogIsEnabled()
@@ -74,7 +74,7 @@ Class WinEventLogRuleConvert : WinEventLogRule
 
     hidden [void] SetDscResource ()
     {
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             $this.DscResource = 'xWinEventLog'
         }
diff --git a/Module/Rule.WinEventLog/WinEventLogRule.psm1 b/source/Module/Rule.WinEventLog/WinEventLogRule.psm1
similarity index 93%
rename from Module/Rule.WinEventLog/WinEventLogRule.psm1
rename to source/Module/Rule.WinEventLog/WinEventLogRule.psm1
index a5dfa8aa7..5ae14d320 100644
--- a/Module/Rule.WinEventLog/WinEventLogRule.psm1
+++ b/source/Module/Rule.WinEventLog/WinEventLogRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER IsEnabled
         The enabled status of the log
 #>
-Class WinEventLogRule : Rule
+class WinEventLogRule : Rule
 {
     [string] $LogName
     [bool] $IsEnabled <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class WinEventLogRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    WinEventLogRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    WinEventLogRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class WinEventLogRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    WinEventLogRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    WinEventLogRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule.WindowsFeature/Convert/Data.ps1 b/source/Module/Rule.WindowsFeature/Convert/Data.ps1
similarity index 100%
rename from Module/Rule.WindowsFeature/Convert/Data.ps1
rename to source/Module/Rule.WindowsFeature/Convert/Data.ps1
diff --git a/Module/Rule.WindowsFeature/Convert/Methods.ps1 b/source/Module/Rule.WindowsFeature/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule.WindowsFeature/Convert/Methods.ps1
rename to source/Module/Rule.WindowsFeature/Convert/Methods.ps1
diff --git a/Module/Rule.WindowsFeature/Convert/WindowsFeatureRule.Convert.psm1 b/source/Module/Rule.WindowsFeature/Convert/WindowsFeatureRule.Convert.psm1
similarity index 96%
rename from Module/Rule.WindowsFeature/Convert/WindowsFeatureRule.Convert.psm1
rename to source/Module/Rule.WindowsFeature/Convert/WindowsFeatureRule.Convert.psm1
index 4747c6ae3..c7a42b128 100644
--- a/Module/Rule.WindowsFeature/Convert/WindowsFeatureRule.Convert.psm1
+++ b/source/Module/Rule.WindowsFeature/Convert/WindowsFeatureRule.Convert.psm1
@@ -23,7 +23,7 @@ foreach ($supportFile in $supportFileList)
         parsing and validation.
 
 #>
-Class WindowsFeatureRuleConvert : WindowsFeatureRule
+class WindowsFeatureRuleConvert : WindowsFeatureRule
 {
     <#
         .SYNOPSIS
@@ -39,7 +39,7 @@ Class WindowsFeatureRuleConvert : WindowsFeatureRule
         .PARAMETER XccdfRule
             The STIG rule to convert
     #>
-    WindowsFeatureRuleConvert ([xml.xmlelement] $XccdfRule) : Base ($XccdfRule, $true)
+    WindowsFeatureRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true)
     {
         $this.SetFeatureName()
         $this.SetFeatureInstallState()
@@ -137,7 +137,7 @@ Class WindowsFeatureRuleConvert : WindowsFeatureRule
     hidden [void] SetDscResource ()
     {
         # Assigns the appropriate Windows Feature DSC Resource
-        if($null -eq $this.DuplicateOf)
+        if ($null -eq $this.DuplicateOf)
         {
             if ($global:stigTitle -match 'Windows 10')
             {
diff --git a/Module/Rule.WindowsFeature/WindowsFeatureRule.psm1 b/source/Module/Rule.WindowsFeature/WindowsFeatureRule.psm1
similarity index 92%
rename from Module/Rule.WindowsFeature/WindowsFeatureRule.psm1
rename to source/Module/Rule.WindowsFeature/WindowsFeatureRule.psm1
index 871dcdbc2..32e318130 100644
--- a/Module/Rule.WindowsFeature/WindowsFeatureRule.psm1
+++ b/source/Module/Rule.WindowsFeature/WindowsFeatureRule.psm1
@@ -14,7 +14,7 @@ using module .\..\Rule\Rule.psm1
     .PARAMETER Ensure
         The state the windows feature should be in
 #>
-Class WindowsFeatureRule : Rule
+class WindowsFeatureRule : Rule
 {
     [string] $Name
     [string] $Ensure <#(ExceptionValue)#>
@@ -33,7 +33,7 @@ Class WindowsFeatureRule : Rule
         .PARAMETER Rule
             The STIG rule to load
     #>
-    WindowsFeatureRule ([xml.xmlelement] $Rule) : Base ($Rule)
+    WindowsFeatureRule ([xml.xmlelement] $Rule) : base ($Rule)
     {
     }
 
@@ -45,7 +45,7 @@ Class WindowsFeatureRule : Rule
         .PARAMETER Convert
             A simple bool flag to create a unique constructor signature
     #>
-    WindowsFeatureRule ([xml.xmlelement] $Rule, [switch] $Convert) : Base ($Rule, $Convert)
+    WindowsFeatureRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert)
     {
     }
 
diff --git a/Module/Rule/Convert/ConvertFactory.psm1 b/source/Module/Rule/Convert/ConvertFactory.psm1
similarity index 81%
rename from Module/Rule/Convert/ConvertFactory.psm1
rename to source/Module/Rule/Convert/ConvertFactory.psm1
index 2a909de61..2d2ce68fd 100644
--- a/Module/Rule/Convert/ConvertFactory.psm1
+++ b/source/Module/Rule/Convert/ConvertFactory.psm1
@@ -25,6 +25,14 @@ using module .\..\..\Rule.WindowsFeature\Convert\WindowsFeatureRule.Convert.psm1
 using module .\..\..\Rule.WinEventLog\Convert\WinEventLogRule.Convert.psm1
 using module .\..\..\Rule.AuditSetting\Convert\AuditSettingRule.Convert.psm1
 using module .\..\..\Rule.SslSettings\Convert\SslSettingsRule.Convert.psm1
+using module .\..\..\Rule.VsphereAdvancedSettings\Convert\VsphereAdvancedSettingsRule.Convert.psm1
+using module .\..\..\Rule.VsphereService\Convert\VsphereServiceRule.Convert.psm1
+using module .\..\..\Rule.VspherePortGroupSecurity\Convert\VspherePortGroupSecurityRule.Convert.psm1
+using module .\..\..\Rule.VsphereAcceptanceLevel\Convert\VsphereAcceptanceLevelRule.Convert.psm1
+using module .\..\..\Rule.VsphereSnmpAgent\Convert\VsphereSnmpAgentRule.Convert.psm1
+using module .\..\..\Rule.VsphereKernelActiveDumpPartition\Convert\VsphereKernelActiveDumpPartitionRule.Convert.psm1
+using module .\..\..\Rule.VsphereNtpSettings\Convert\VsphereNtpSettingsRule.Convert.psm1
+using module .\..\..\Rule.VsphereVssSecurity\Convert\VsphereVssSecurityRule.Convert.psm1
 
 # Header
 
@@ -245,6 +253,54 @@ class ConvertFactory
                     [SslSettingsRuleConvert]::new($Rule).AsRule()
                 )
             }
+            {[VsphereAdvancedSettingsRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VsphereAdvancedSettingsRuleConvert]::new($Rule).AsRule()
+                )
+            }
+            {[VsphereServiceRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VsphereServiceRuleConvert]::new($Rule).AsRule()
+                )
+            }
+            {[VspherePortGroupSecurityRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VspherePortGroupSecurityRuleConvert]::new($Rule).AsRule()
+                )
+            }
+            {[VsphereAcceptanceLevelRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VsphereAcceptanceLevelRuleConvert]::new($Rule).AsRule()
+                )
+            }
+            {[VsphereSnmpAgentRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VsphereSnmpAgentRuleConvert]::new($Rule).AsRule()
+                )
+            }
+            {[VsphereKernelActiveDumpPartitionRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VsphereKernelActiveDumpPartitionRuleConvert]::new($Rule).AsRule()
+                )
+            }
+            {[VsphereNtpSettingsRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VsphereNtpSettingsRuleConvert]::new($Rule).AsRule()
+                )
+            }
+            {[VsphereVssSecurityRuleConvert]::Match($PSItem)}
+            {
+                $null = $ruleTypeList.Add(
+                    [VsphereVssSecurityRuleConvert]::new($Rule).AsRule()
+                )
+            }
             <#
                 Some rules have a documentation requirement only for exceptions,
                 so the DocumentRule needs to be at the end of the switch as a
diff --git a/Module/Rule/Convert/Data.Core.ps1 b/source/Module/Rule/Convert/Data.Core.ps1
similarity index 100%
rename from Module/Rule/Convert/Data.Core.ps1
rename to source/Module/Rule/Convert/Data.Core.ps1
diff --git a/Module/Rule/Convert/Data.McAfee.ps1 b/source/Module/Rule/Convert/Data.McAfee.ps1
similarity index 100%
rename from Module/Rule/Convert/Data.McAfee.ps1
rename to source/Module/Rule/Convert/Data.McAfee.ps1
diff --git a/Module/Rule/Convert/Data.Office.ps1 b/source/Module/Rule/Convert/Data.Office.ps1
similarity index 100%
rename from Module/Rule/Convert/Data.Office.ps1
rename to source/Module/Rule/Convert/Data.Office.ps1
diff --git a/Module/Rule/Convert/Data.Windows.Defender.ps1 b/source/Module/Rule/Convert/Data.Windows.Defender.ps1
similarity index 100%
rename from Module/Rule/Convert/Data.Windows.Defender.ps1
rename to source/Module/Rule/Convert/Data.Windows.Defender.ps1
diff --git a/Module/Rule/Convert/Functions.ps1 b/source/Module/Rule/Convert/Functions.ps1
similarity index 99%
rename from Module/Rule/Convert/Functions.ps1
rename to source/Module/Rule/Convert/Functions.ps1
index 6a437806c..86a12f9fe 100644
--- a/Module/Rule/Convert/Functions.ps1
+++ b/source/Module/Rule/Convert/Functions.ps1
@@ -91,7 +91,7 @@ function Get-HardCodedString
         $StigId
     )
 
-    Switch ($stigId)
+    switch ($stigId)
     {
         {$PSItem -match 'V-(1089|63675|73647|93147)'}
         {
@@ -183,7 +183,7 @@ function Get-HardCodedString
         $StigId
     )
 
-    Switch ($stigId)
+    switch ($stigId)
     {
         {$PSItem -match 'V-3472.b'}
         {
diff --git a/Module/Rule/Convert/Methods.ps1 b/source/Module/Rule/Convert/Methods.ps1
similarity index 100%
rename from Module/Rule/Convert/Methods.ps1
rename to source/Module/Rule/Convert/Methods.ps1
diff --git a/source/Module/Rule/Rule.LoadFactory.psm1 b/source/Module/Rule/Rule.LoadFactory.psm1
new file mode 100644
index 000000000..996ef932f
--- /dev/null
+++ b/source/Module/Rule/Rule.LoadFactory.psm1
@@ -0,0 +1,76 @@
+using module .\..\Rule.AccountPolicy\AccountPolicyRule.psm1
+using module .\..\Rule.AuditPolicy\AuditPolicyRule.psm1
+using module .\..\Rule.DnsServerRootHint\DnsServerRootHintRule.psm1
+using module .\..\Rule.DnsServerSetting\DnsServerSettingRule.psm1
+using module .\..\Rule.Document\DocumentRule.psm1
+using module .\..\Rule.FileContent\FileContentRule.psm1
+using module .\..\Rule.Group\GroupRule.psm1
+using module .\..\Rule.IISLogging\IISLoggingRule.psm1
+using module .\..\Rule.Manual\ManualRule.psm1
+using module .\..\Rule.MimeType\MimeTypeRule.psm1
+using module .\..\Rule.Permission\PermissionRule.psm1
+using module .\..\Rule.ProcessMitigation\ProcessMitigationRule.psm1
+using module .\..\Rule.Registry\RegistryRule.psm1
+using module .\..\Rule.SecurityOption\SecurityOptionRule.psm1
+using module .\..\Rule.Service\ServiceRule.psm1
+using module .\..\Rule.SqlScriptQuery\SqlScriptQueryRule.psm1
+using module .\..\Rule.UserRight\UserRightRule.psm1
+using module .\..\Rule.WebAppPool\WebAppPoolRule.psm1
+using module .\..\Rule.WebConfigurationProperty\WebConfigurationPropertyRule.psm1
+using module .\..\Rule.WindowsFeature\WindowsFeatureRule.psm1
+using module .\..\Rule.WinEventLog\WinEventLogRule.psm1
+using module .\..\Rule.AuditSetting\AuditSettingRule.psm1
+using module .\..\Rule.SslSettings\SslSettingsRule.psm1
+using module .\..\Rule.VsphereAdvancedSettings\VsphereAdvancedSettingsRule.psm1
+using module .\..\Rule.VsphereService\VsphereServiceRule.psm1
+using module .\..\Rule.VspherePortGroupSecurity\VspherePortGroupSecurityRule.psm1
+using module .\..\Rule.VsphereAcceptanceLevel\VsphereAcceptanceLevelRule.psm1
+using module .\..\Rule.VsphereSnmpAgent\VsphereSnmpAgentRule.psm1
+using module .\..\Rule.VsphereKernelActiveDumpPartition\VsphereKernelActiveDumpPartitionRule.psm1
+using module .\..\Rule.VsphereNtpSettings\VsphereNtpSettingsRule.psm1
+using module .\..\Rule.VsphereVssSecurity\VsphereVssSecurityRule.psm1
+#header
+
+class LoadFactory
+{
+    static [psobject] Rule ([xml.xmlelement] $Rule)
+    {
+        $return = $null
+        switch ($Rule.ParentNode.Name)
+        {
+            'AccountPolicyRule'                    {$return = [AccountPolicyRule]::new($Rule)}
+            'AuditPolicyRule'                      {$return = [AuditPolicyRule]::new($Rule)}
+            'DnsServerSettingRule'                 {$return = [DnsServerSettingRule]::new($Rule)}
+            'DnsServerRootHintRule'                {$return = [DnsServerRootHintRule]::new($Rule)}
+            'DocumentRule'                         {$return = [DocumentRule]::new($Rule)}
+            'FileContentRule'                      {$return = [FileContentRule]::new($Rule)}
+            'GroupRule'                            {$return = [GroupRule]::new($Rule)}
+            'IisLoggingRule'                       {$return = [IisLoggingRule]::new($Rule)}
+            'MimeTypeRule'                         {$return = [MimeTypeRule]::new($Rule)}
+            'ManualRule'                           {$return = [ManualRule]::new($Rule)}
+            'PermissionRule'                       {$return = [PermissionRule]::new($Rule)}
+            'ProcessMitigationRule'                {$return = [ProcessMitigationRule]::new($Rule)}
+            'RegistryRule'                         {$return = [RegistryRule]::new($Rule)}
+            'SecurityOptionRule'                   {$return = [SecurityOptionRule]::new($Rule)}
+            'ServiceRule'                          {$return = [ServiceRule]::new($Rule)}
+            'SqlScriptQueryRule'                   {$return = [SqlScriptQueryRule]::new($Rule)}
+            'UserRightRule'                        {$return = [UserRightRule]::new($Rule)}
+            'WebAppPoolRule'                       {$return = [WebAppPoolRule]::new($Rule)}
+            'WebConfigurationPropertyRule'         {$return = [WebConfigurationPropertyRule]::new($Rule)}
+            'WindowsFeatureRule'                   {$return = [WindowsFeatureRule]::new($Rule)}
+            'WinEventLogRule'                      {$return = [WinEventLogRule]::new($Rule)}
+            'AuditSettingRule'                     {$return = [AuditSettingRule]::new($Rule)}
+            'SslSettingsRule'                      {$return = [SslSettingsRule]::new($Rule)}
+            'VsphereAdvancedSettingsRule'          {$return = [VsphereAdvancedSettingsRule]::new($Rule)}
+            'VsphereServiceRule'                   {$return = [VsphereServiceRule]::new($Rule)}
+            'VspherePortGroupSecurityRule'         {$return = [VspherePortGroupSecurityRule]::new($Rule)}
+            'VsphereAcceptanceLevelRule'           {$return = [VsphereAcceptanceLevelRule]::new($Rule)}
+            'VsphereSnmpAgentRule'                 {$return = [VsphereSnmpAgentRule]::new($Rule)}
+            'VsphereKernelActiveDumpPartitionRule' {$return = [VsphereKernelActiveDumpPartitionRule]::new($Rule)}
+            'VsphereNtpSettingsRule'               {$return = [VsphereNtpSettingsRule]::new($Rule)}
+            'VsphereVssSecurityRule'               {$return = [VsphereVssSecurityRule]::new($Rule)}
+        }
+
+        return $return
+    }
+}
diff --git a/Module/Rule/Rule.psm1 b/source/Module/Rule/Rule.psm1
similarity index 99%
rename from Module/Rule/Rule.psm1
rename to source/Module/Rule/Rule.psm1
index 9865a07ea..42c44db1c 100644
--- a/Module/Rule/Rule.psm1
+++ b/source/Module/Rule/Rule.psm1
@@ -40,7 +40,7 @@ foreach ($supportFile in $supportFileList)
     .PARAMETER DscResource
         Defines the DSC resource used to configure the rule
 #>
-Class Rule : ICloneable
+class Rule : ICloneable
 {
     [string] $Id
     [string] $Title
@@ -100,7 +100,7 @@ Class Rule : ICloneable
     #>
     Rule ([xml.xmlelement] $Rule, [switch] $Convert)
     {
-        # This relaces the current InvokeClass method
+        # This relaces the current Invokeclass method
         $this.Id = $Rule.Id
         $this.Title = $Rule.Title
         $this.Severity = $Rule.rule.severity
diff --git a/Module/STIG/Convert/Convert.Main.psm1 b/source/Module/STIG/Convert/Convert.Main.psm1
similarity index 100%
rename from Module/STIG/Convert/Convert.Main.psm1
rename to source/Module/STIG/Convert/Convert.Main.psm1
diff --git a/source/Module/STIG/Convert/Data.ps1 b/source/Module/STIG/Convert/Data.ps1
new file mode 100644
index 000000000..4fc4bff30
--- /dev/null
+++ b/source/Module/STIG/Convert/Data.ps1
@@ -0,0 +1,53 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+data xmlAttribute
+{
+    ConvertFrom-StringData -StringData @'
+        ruleId                = id
+        ruleSeverity          = severity
+        ruleConversionStatus  = conversionstatus
+        ruleTitle             = title
+        ruleDscResource       = dscresource
+        ruleDscResourceModule = dscresourcemodule
+
+        organizationalSettingValue = value
+'@
+}
+
+data dscResourceModule
+{
+    ConvertFrom-StringData -StringData @'
+        AccountPolicyRule                    = SecurityPolicyDsc
+        AuditPolicyRule                      = AuditPolicyDsc
+        DnsServerSettingRule                 = xDnsServer
+        DnsServerRootHintRule                = PSDscResources
+        DocumentRule                         = None
+        GroupRule                            = PSDscResources
+        IisLoggingRule                       = xWebAdministration
+        MimeTypeRule                         = xWebAdministration
+        ManualRule                           = None
+        PermissionRule                       = AccessControlDsc
+        ProcessMitigationRule                = WindowsDefenderDsc
+        RegistryRule                         = PSDscResources
+        SecurityOptionRule                   = SecurityPolicyDsc
+        ServiceRule                          = PSDscResources
+        SqlScriptQueryRule                   = SqlServerDsc
+        UserRightRule                        = SecurityPolicyDsc
+        WebAppPoolRule                       = xWebAdministration
+        WebConfigurationPropertyRule         = xWebAdministration
+        WindowsFeatureRule                   = PSDscResources
+        WinEventLogRule                      = xWinEventLog
+        SslSettingsRule                      = xWebAdministration
+        AuditSettingRule                     = AuditSystemDsc
+        FileContentRule                      = FileContentDsc
+        VsphereAdvancedSettingsRule          = Vmware.vSphereDSC
+        VsphereServiceRule                   = Vmware.vSphereDSC
+        VspherePortGroupSecurityRule         = Vmware.vSphereDSC
+        VsphereAcceptanceLevelRule           = Vmware.vSphereDSC
+        VsphereKernelActiveDumpPartitionRule = Vmware.vSphereDSC
+        VsphereSnmpAgentRule                 = Vmware.vSphereDSC
+        VsphereNtpSettingsRule               = Vmware.vSphereDSC
+        VsphereVssSecurityRule               = Vmware.vSphereDSC
+'@
+}
diff --git a/Module/STIG/Convert/Functions.PowerStigXml.ps1 b/source/Module/STIG/Convert/Functions.PowerStigXml.ps1
similarity index 100%
rename from Module/STIG/Convert/Functions.PowerStigXml.ps1
rename to source/Module/STIG/Convert/Functions.PowerStigXml.ps1
diff --git a/Module/STIG/Convert/Functions.Report.ps1 b/source/Module/STIG/Convert/Functions.Report.ps1
similarity index 100%
rename from Module/STIG/Convert/Functions.Report.ps1
rename to source/Module/STIG/Convert/Functions.Report.ps1
diff --git a/Module/STIG/Functions.Checklist.ps1 b/source/Module/STIG/Functions.Checklist.ps1
similarity index 100%
rename from Module/STIG/Functions.Checklist.ps1
rename to source/Module/STIG/Functions.Checklist.ps1
diff --git a/Module/STIG/Functions.DomainName.ps1 b/source/Module/STIG/Functions.DomainName.ps1
similarity index 99%
rename from Module/STIG/Functions.DomainName.ps1
rename to source/Module/STIG/Functions.DomainName.ps1
index 0c3c99f33..60a580ae4 100644
--- a/Module/STIG/Functions.DomainName.ps1
+++ b/source/Module/STIG/Functions.DomainName.ps1
@@ -143,7 +143,7 @@ Function Get-NetbiosName
     )
 
     $parts = Get-DomainParts -FQDN $FQDN
-    If ($parts.Count -gt 1)
+    if ($parts.Count -gt 1)
     {
         return $parts[0]
     }
diff --git a/Module/STIG/STIG.psm1 b/source/Module/STIG/STIG.psm1
similarity index 99%
rename from Module/STIG/STIG.psm1
rename to source/Module/STIG/STIG.psm1
index e070c21ad..f0799bdbc 100644
--- a/Module/STIG/STIG.psm1
+++ b/source/Module/STIG/STIG.psm1
@@ -33,7 +33,7 @@ using module .\..\Rule.Skip\Skip.psm1
         This class requires PowerShell v5 or above.
 #>
 
-Class STIG
+class STIG
 {
     [string] $Technology # this is aligned to a DSC composite resource.
     [string] $TechnologyVersion # this is 2012R2, 2016, etc.
@@ -216,7 +216,7 @@ Class STIG
         }
 
         # If there are no org settings to merge, skip over that
-        if($null -ne $settings)
+        if ($null -ne $settings)
         {
             foreach ($ruleId in $settings.Keys)
             {
@@ -308,7 +308,7 @@ Class STIG
         ).ModuleVersion
 
         # load the STIG rules if they are not already laoded
-        if($this.RuleList.Count -le 0)
+        if ($this.RuleList.Count -le 0)
         {
             $this.LoadRules()
         }
@@ -332,7 +332,7 @@ Class STIG
         $null = $return.AppendLine("   The $($rule.GetType().ToString()) property '$($rule.GetOverrideValue())' can be overridden ")
         $null = $return.AppendLine('   with an exception using the syntax below.')
         $null = $return.AppendLine('')
-        if($null -ne $exceptionHelp.Notes)
+        if ($null -ne $exceptionHelp.Notes)
         {
             $null = $return.AppendLine('NOTES')
             $null = $return.AppendLine("   $($exceptionHelp.Notes)")
diff --git a/PowerStig.Convert.psm1 b/source/PowerStig.Convert.psm1
similarity index 68%
rename from PowerStig.Convert.psm1
rename to source/PowerStig.Convert.psm1
index 2f6729190..8fb3284b3 100644
--- a/PowerStig.Convert.psm1
+++ b/source/PowerStig.Convert.psm1
@@ -3,11 +3,10 @@
 #Requires -Version 5.1
 
 <#
-    A funny note if you have OCD. The order of the dot sourced files is important due to the way
-    that PowerShell processes the files (Top/Down). The Classes in the module depend on the
-    enumerations, so if you want to alphabetize this list, don't. PowerShell with throw an error
-    indicating that the enumerations can't be found, if you try to load the classes before the
-    enumerations.
+    The order of the dot sourced files is important due to the way that PowerShell processes the
+    files (Top/Down). The Classes in the module depend on the enumerations, so if you want to
+    alphabetize this list, don't. PowerShell with throw an error indicating that the enumerations
+    can't be found, if you try to load the classes before the enumerations.
 #>
 using module .\Module\Common\Common.psm1
 using module .\Module\Rule\Rule.psm1
@@ -35,6 +34,14 @@ using module .\Module\Rule.WindowsFeature\Convert\WindowsFeatureRule.Convert.psm
 using module .\Module\Rule.WinEventLog\Convert\WinEventLogRule.Convert.psm1
 using module .\Module\Rule.SslSettings\Convert\SslSettingsRule.Convert.psm1
 using module .\Module\Rule.AuditSetting\Convert\AuditSettingRule.Convert.psm1
+using module .\Module\Rule.VsphereAdvancedSettings\Convert\VsphereAdvancedSettingsRule.Convert.psm1
+using module .\Module\Rule.VsphereService\Convert\VsphereServiceRule.Convert.psm1
+using module .\Module\Rule.VspherePortGroupSecurity\Convert\VspherePortGroupSecurityRule.Convert.psm1
+using module .\Module\Rule.VsphereAcceptanceLevel\Convert\VsphereAcceptanceLevelRule.Convert.psm1
+using module .\Module\Rule.VsphereSnmpAgent\Convert\VsphereSnmpAgentRule.Convert.psm1
+using module .\Module\Rule.VsphereKernelActiveDumpPartition\Convert\VsphereKernelActiveDumpPartitionRule.Convert.psm1
+using module .\Module\Rule.VsphereNtpSettings\Convert\VsphereNtpSettingsRule.Convert.psm1
+using module .\Module\Rule.VsphereVssSecurity\Convert\VsphereVssSecurityRule.Convert.psm1
 
 # load the public functions
 foreach ($supportFile in ( Get-ChildItem -Path "$PSScriptRoot\Module\Stig\Convert" -Recurse -Filter '*.ps1' -Exclude 'Data.*.ps1' ) )
diff --git a/PowerStig.psd1 b/source/PowerStig.psd1
similarity index 58%
rename from PowerStig.psd1
rename to source/PowerStig.psd1
index d6ee88213..5b8867ff0 100644
--- a/PowerStig.psd1
+++ b/source/PowerStig.psd1
@@ -6,7 +6,7 @@
 RootModule = 'PowerStig.psm1'
 
 # Version number of this module.
-ModuleVersion = '4.3.0'
+ModuleVersion = '0.0.1'
 
 # ID used to uniquely identify this module
 GUID = 'a132f6a5-8f96-4942-be25-b213ee7e4af3'
@@ -26,7 +26,7 @@ Description = 'The PowerStig module provides a set of PowerShell classes to acce
 2. Ignoring a single or entire class of rules (auto-documenting)
 3. Organizational settings to address STIG rules that have allowable ranges.
 
-This module is intended to be used by additional automation as a lightweight portable “database” to audit and enforce the parsed STIG data.'
+This module is intended to be used by additional automation as a lightweight portable database to audit and enforce the parsed STIG data.'
 
 # Minimum version of the Windows PowerShell engine required by this module
 PowerShellVersion = '5.1'
@@ -47,7 +47,15 @@ RequiredModules  = @(
     @{ModuleName = 'SqlServerDsc'; ModuleVersion = '13.3.0'},
     @{ModuleName = 'WindowsDefenderDsc'; ModuleVersion = '1.0.0.0'},
     @{ModuleName = 'xDnsServer'; ModuleVersion = '1.11.0.0'},
-    @{ModuleName = 'xWebAdministration'; ModuleVersion = '2.5.0.0'}
+    @{ModuleName = 'xWebAdministration'; ModuleVersion = '2.5.0.0'},
+    @{ModuleName = 'VMware.VimAutomation.Sdk'; ModuleVersion = '12.0.0.15939651'},
+    @{ModuleName = 'VMware.VimAutomation.Common'; ModuleVersion = '12.0.0.15939652'},
+    @{ModuleName = 'VMware.Vim'; ModuleVersion ='7.0.0.15939650'},
+    @{ModuleName = 'VMware.VimAutomation.Cis.Core'; ModuleVersion = '12.0.0.15939657'},
+    @{ModuleName = 'VMware.VimAutomation.Core'; ModuleVersion = '12.0.0.15939655'},
+    @{ModuleName = 'VMware.VimAutomation.Storage'; ModuleVersion = '11.5.0.14901686'},
+    @{ModuleName = 'VMware.VimAutomation.Vds'; ModuleVersion = '11.2.0.12483615'},
+    @{ModuleName = 'Vmware.vSphereDsc'; ModuleVersion = '2.1.0.58'}
 )
 
 # DSC resources to export from this module
@@ -66,7 +74,8 @@ DscResourcesToExport = @(
     'WindowsDefender',
     'WindowsDnsServer',
     'WindowsFirewall',
-    'WindowsServer'
+    'WindowsServer',
+    'Vsphere'
 )
 
 # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
@@ -103,27 +112,11 @@ PrivateData = @{
         # A URL to the main website for this project.
         ProjectUri = 'https://github.com/Microsoft/PowerStig'
 
+        # Prerelease string value if the release should be a prerelease.
+        Prerelease = ''
+
         # ReleaseNotes of this module
-        ReleaseNotes = '* Update PowerSTIG to Expand .NET STIG Automation: [#591](https://github.com/microsoft/PowerStig/issues/591)
-        * Update PowerSTIG to parse and apply McAfee VirusScan 8.8 Local Client STIG V5R16: [#588](https://github.com/microsoft/PowerStig/issues/588)
-        * Update PowerSTIG to successfully parse Microsoft SQL Server 2016 Instance STIG - Ver 1, Rel 8: [#586](https://github.com/microsoft/PowerStig/issues/586)
-        * Update PowerSTIG to parse and apply Windows Server 2019 V1R3 STIG: [#584](https://github.com/microsoft/PowerStig/issues/584)
-        * Update PowerSTIG to parse/convert the Windows Server 2016 V2R10: [#582](https://github.com/microsoft/PowerStig/issues/582)
-        * Update PowerSTIG to parse/convert the Windows Server 2012 DNS STIG V1R13: [#580](https://github.com/microsoft/PowerStig/issues/580)
-        * Update PowerSTIG to to parse/convert the Windows Server 2012 R2 DC V2R19: [#578](https://github.com/microsoft/PowerStig/issues/578)
-        * Update PowerSTIG to parse/convert the Windows Defender STIG V1R7: [#576](https://github.com/microsoft/PowerStig/issues/576)
-        * Update PowerSTIG to successfully parse Mozilla Firefox STIG - Ver 4, Rel 28: [#573](https://github.com/microsoft/PowerStig/issues/573)
-        * Update PowerSTIG to parse and apply Adobe Acrobat Reader Version 1, Release 6: [#562](https://github.com/microsoft/PowerStig/issues/562)
-        * Update PowerSTIG release process to include STIG Coverage markdown wiki automation: [#560](https://github.com/microsoft/PowerStig/issues/560)
-        * Update to PowerSTIG to show duplicate rule status matching in a checklist: [#257](https://github.com/microsoft/PowerStig/issues/257)
-        * Fixed [#589](https://github.com/microsoft/PowerStig/issues/589): Update module manifest to leverage GPRegistryPolicyDsc v1.2.0
-        * Fixed [#569](https://github.com/microsoft/PowerStig/issues/569): Update SqlServerDsc module version references
-        * Fixed [#259](https://github.com/microsoft/PowerStig/issues/259): Checklist .ckl file fails XML validation in Stig Viewer 2.8.
-        * Fixed [#527](https://github.com/microsoft/PowerStig/issues/527): Checklist is not using manualcheckfile when using DscResult.
-        * Fixed [#548](https://github.com/microsoft/PowerStig/issues/548): Target/host data is blank when creating a new checklist.
-        * Fixed [#546](https://github.com/microsoft/PowerStig/issues/546): Typecast causing an issue when trying to generate checklist using New-StigChecklist function.
-        * Fixed [#401](https://github.com/microsoft/PowerStig/issues/401): Checklists generated by New-StigChecklist do not provide finding details.
-        * Fixed [#593](https://github.com/microsoft/PowerStig/issues/593): Update PowerSTIG Convert naming conventions of output STIGs'
+        ReleaseNotes = ''
         } # End of PSData hashtable
     } # End of PrivateData hashtable
 }
diff --git a/PowerStig.psm1 b/source/PowerStig.psm1
similarity index 100%
rename from PowerStig.psm1
rename to source/PowerStig.psm1
diff --git a/StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.log b/source/StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.log
rename to source/StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.log
diff --git a/StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.xml b/source/StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.xml
rename to source/StigData/Archive/Adobe/U_Adobe_Acrobat_Reader_DC_Continuous_STIG_V1R6_Manual-xccdf.xml
diff --git a/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.log b/source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.log
rename to source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.log
diff --git a/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.xml b/source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.xml
rename to source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R8_Manual-xccdf.xml
diff --git a/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.log b/source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.log
rename to source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.log
diff --git a/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.xml b/source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.xml
rename to source/StigData/Archive/DotNet/U_MS_DotNet_Framework_4-0_STIG_V1R9_Manual-xccdf.xml
diff --git a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.log b/source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.log
similarity index 51%
rename from StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.log
rename to source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.log
index 2336d398c..3a6fdc142 100644
--- a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.log
+++ b/source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.log
@@ -1,3 +1,5 @@
 V-46515::HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3::HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
 V-46815::is REG_SZ = 'no',::is REG_SZ = no,
 V-46987::REG_SZ = 'PMEM',::REG_SZ = PMEM,
+V-75169::Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.::''
+V-75171::Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.::''
diff --git a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.xml b/source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.xml
rename to source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R17_Manual-xccdf.xml
diff --git a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log b/source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log
similarity index 51%
rename from StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log
rename to source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log
index 2336d398c..3a6fdc142 100644
--- a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log
+++ b/source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log
@@ -1,3 +1,5 @@
 V-46515::HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3::HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
 V-46815::is REG_SZ = 'no',::is REG_SZ = no,
 V-46987::REG_SZ = 'PMEM',::REG_SZ = PMEM,
+V-75169::Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.::''
+V-75171::Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.::''
diff --git a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.xml b/source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.xml
rename to source/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.xml
diff --git a/StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.log b/source/StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.log
rename to source/StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.log
diff --git a/StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.xml b/source/StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.xml
rename to source/StigData/Archive/McAfee/U_McAfee_VirusScan88_Local_Client_STIG_V5R16_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_MS_Excel_2013_STIG_V1R7_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MS_Excel_2013_STIG_V1R7_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_MS_Excel_2013_STIG_V1R7_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_MS_Excel_2013_STIG_V1R7_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.log b/source/StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_MS_Excel_2016_STIG_V1R2_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log b/source/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_MS_PowerPoint_2013_V1R6_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MS_PowerPoint_2013_V1R6_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_MS_PowerPoint_2013_V1R6_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_MS_PowerPoint_2013_V1R6_Manual-xccdf.xml
diff --git a/source/StigData/Archive/Office/U_MS_Visio_2013_STIG_V1R4_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MS_Visio_2013_STIG_V1R4_Manual-xccdf.xml
new file mode 100644
index 000000000..a8b046be7
--- /dev/null
+++ b/source/StigData/Archive/Office/U_MS_Visio_2013_STIG_V1R4_Manual-xccdf.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Microsoft_Visio_2013" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2018-04-04">accepted</status><title>Microsoft Visio 2013 STIG</title><description>The Microsoft Visio 2013 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.  Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 4 Benchmark Date: 27 Apr 2018</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40730" selected="true" /><select idref="V-40731" selected="true" /><select idref="V-40732" selected="true" /><select idref="V-40733" selected="true" /><select idref="V-40734" selected="true" /><select idref="V-40735" selected="true" /><select idref="V-40736" selected="true" /><select idref="V-40737" selected="true" /><select idref="V-40738" selected="true" /><select idref="V-40739" selected="true" /><select idref="V-40740" selected="true" /><select idref="V-40741" selected="true" /><select idref="V-40742" selected="true" /></Profile><Group id="V-40730"><title>DTOO104 - Disabling of user name and password</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52788r1_rule" severity="medium" weight="10.0"><version>DTOO104</version><title>Disabling of user name and password syntax from being used in URLs must be enforced.</title><description>&lt;VulnDiscussion&gt;The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate Website but actually opens a deceptive (spoofed) Website. For example, the URL http://www.wingtiptoys.com@example.com appears to open http://www.wingtiptoys.com but actually opens http://example.com. To protect users from such attacks, Internet Explorer usually blocks any URLs using this syntax.
+
+This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). If user names and passwords in URLs are allowed, users could be diverted to dangerous Web pages, which could pose a security risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-45714r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Disable user name and password" to "Enabled" and place check in 'visio.exe' check box.</fixtext><fix id="F-45714r1_fix" /><check system="C-47117r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Disable user name and password" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40731"><title>DTOO111 - IE Bind to Object</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52789r1_rule" severity="medium" weight="10.0"><version>DTOO111</version><title>The Internet Explorer Bind to Object functionality must be enabled.</title><description>&lt;VulnDiscussion&gt;Internet Explorer performs a number of safety checks before initializing an ActiveX control. It will not initialize a control if the kill bit for the control is set in the registry, or if the security settings for the zone in which the control is located do not allow it to be initialized.
+This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). A security risk could occur if potentially dangerous controls are allowed to load.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001695</ident><fixtext fixref="F-45715r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Bind to object" to "Enabled" and place check in 'visio.exe' check box.</fixtext><fix id="F-45715r1_fix" /><check system="C-47118r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Bind to object" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40732"><title>DTOO117 - Saved from URL</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52790r1_rule" severity="medium" weight="10.0"><version>DTOO117</version><title>The Saved from URL mark must be selected to enforce Internet zone processing.</title><description>&lt;VulnDiscussion&gt;Typically, when Internet Explorer loads a web page from a Universal Naming Convention (UNC) share that contains a Mark of the Web (MOTW) comment, indicating the page was saved from a site on the Internet; Internet Explorer runs the page in the Internet security zone instead of the less restrictive Local Intranet security zone. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer does not evaluate the page for a MOTW, potentially dangerous code could be allowed to run.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-45716r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Saved from URL" to "Enabled" and place check in 'visio.exe' check box.</fixtext><fix id="F-45716r1_fix" /><check system="C-47119r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Saved from URL" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40733"><title>DTOO123 - Block Navigation to URL from Office </title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52791r1_rule" severity="medium" weight="10.0"><version>DTOO123</version><title>Navigation to URLs embedded in Office products must be blocked.</title><description>&lt;VulnDiscussion&gt;To protect users from attacks, Internet Explorer usually does not attempt to load malformed URLs. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer attempts to load a malformed URL, a security risk could occur.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-45717r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Navigate URL" to "Enabled" and 'visio.exe'  is checked.</fixtext><fix id="F-45717r1_fix" /><check system="C-47120r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Navigate URL" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40734"><title>DTOO124 - Scripted Window Security</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52792r1_rule" severity="medium" weight="10.0"><version>DTOO124</version><title>Scripted Window Security must be enforced.</title><description>&lt;VulnDiscussion&gt;Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site to take control of the users' computers in some manner. Disabling or not configuring this setting allows unknown websites to:
+-Create browser windows appearing to be from the local operating system.
+-Draw active windows displaying outside of the viewable areas of the screen capturing keyboard input.
+-Overlay parent windows with their own browser windows to hide important system information, choices or prompts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001695</ident><fixtext fixref="F-45718r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Scripted Window Security Restrictions" to "Enabled" and 'visio.exe' is checked.</fixtext><fix id="F-45718r1_fix" /><check system="C-47121r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Scripted Window Security Restrictions" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40735"><title>DTOO126 - Add-on Management</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52793r1_rule" severity="medium" weight="10.0"><version>DTOO126</version><title>Add-on Management functionality must be allowed.</title><description>&lt;VulnDiscussion&gt;Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons may contain viruses or other malicious code. Disabling or not configuring this setting could allow malicious code or users to become active on user computers or the network. For example, a malicious user can monitor and then use keystrokes users type into Internet Explorer. Even legitimate add-ons may demand resources, compromising the performance of Internet Explorer, and the operating systems for user computers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-45719r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Add-on Management" to "Enabled" and place check in 'visio.exe' check box.</fixtext><fix id="F-45719r1_fix" /><check system="C-47122r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Add-on Management" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\software\Microsoft\internet explorer\main\featurecontrol\feature_addon_management
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40736"><title>DTOO127 - Add-ins are signed by Trusted Publisher</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52794r1_rule" severity="medium" weight="10.0"><version>DTOO127</version><title>Add-ins to Office applications must be signed by a Trusted Publisher.</title><description>&lt;VulnDiscussion&gt;Office 2013 applications do not check the digital signature on application add-ins before opening them.  Disabling or not configuring this setting may allow an application to load a dangerous add-in.  As a result, malicious code could become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001749</ident><fixtext fixref="F-45720r1_fix">Set the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "Require that application add-ins are signed by Trusted Publisher" to "Enabled".</fixtext><fix id="F-45720r1_fix" /><check system="C-47123r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "Require that application add-ins are signed by Trusted Publisher" is set to "Enabled".
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKCU\software\policies\Microsoft\office\15.0\Visio\security
+
+Criteria: If the value requireaddinsig is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40737"><title>DTOO129 - Block Pop-Ups</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52795r1_rule" severity="medium" weight="10.0"><version>DTOO129</version><title>Links that invoke instances of IE from within an Office product must be blocked.</title><description>&lt;VulnDiscussion&gt;The Pop-up Blocker feature in Internet Explorer can be used to block most unwanted pop-up and pop-under windows from appearing. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). If the Pop-up Blocker is disabled, disruptive and potentially dangerous pop-up windows could load and present a security risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-45721r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Block popups" to "Enabled" and place check in 'visio.exe' check box.</fixtext><fix id="F-45721r1_fix" /><check system="C-47124r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Block popups" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40738"><title>DTOO131 - Trust Bar Notifications</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52796r1_rule" severity="medium" weight="10.0"><version>DTOO131</version><title>Trust Bar Notifications for unsigned applications must be disabled.</title><description>&lt;VulnDiscussion&gt;If an application is configured to require all add-ins to be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message informing users about the unsigned add-in. If a user is allowed to make the determination to allow an unsigned add-in, it increases the risk of malicious code being introduced onto the user's computer or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001749</ident><fixtext fixref="F-45722r1_fix">Set the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "Disable Trust Bar Notification for unsigned application add-ins and block them" to "Enabled".</fixtext><fix id="F-45722r1_fix" /><check system="C-47125r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled".
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKCU\software\policies\Microsoft\office\15.0\Visio\security
+
+Criteria: If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40739"><title>DTOO132 - Restrict File Download</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52797r1_rule" severity="medium" weight="10.0"><version>DTOO132</version><title>File downloads must be configured for proper restrictions.</title><description>&lt;VulnDiscussion&gt;Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the download. User preferences may also allow the download to occur without prompting or interaction with the user. Even if Internet Explorer prompts the user to accept the download, some websites abuse this functionality. Malicious websites may continually prompt users to download a file or present confusing dialog boxes to trick users into downloading or running a file. If the download occurs and it contains malicious code, the code could become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001169</ident><fixtext fixref="F-45723r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Restrict File Download" to "Enabled" and 'visio.exe' is checked.</fixtext><fix id="F-45723r1_fix" /><check system="C-47126r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Restrict File Download" is set to "Enabled" and 'Visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40740"><title>DTOO209 - Zone Elevation Protection</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52798r1_rule" severity="medium" weight="10.0"><version>DTOO209</version><title>Protection from zone elevation must be enforced.</title><description>&lt;VulnDiscussion&gt;Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine zone, making this security zone a prime target for malicious users and code. Disabling or not configuring this setting could allow pages in the Internet zone to navigate to pages in the Local Machine zone to then run code to elevate privileges. This could allow malicious code or users to become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001695</ident><fixtext fixref="F-45724r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Protection From Zone Elevation" to "Enabled" and 'visio.exe' is checked.</fixtext><fix id="F-45724r1_fix" /><check system="C-47127r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Protection From Zone Elevation" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40741"><title>DTOO211 - Restrict ActiveX Install</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52799r1_rule" severity="medium" weight="10.0"><version>DTOO211</version><title>ActiveX installs must be configured for proper restrictions.</title><description>&lt;VulnDiscussion&gt;Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like the other types of HTML or Microsoft Silverlight-based controls. Disabling or not configuring this setting does not block prompts for ActiveX control installations and these prompts display to users. This could allow malicious code to become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002460</ident><fixtext fixref="F-45725r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Restrict ActiveX Install" to "Enabled" and 'visio.exe' is checked.</fixtext><fix id="F-45725r1_fix" /><check system="C-47128r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Restrict ActiveX Install" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-40742"><title>DTOO304 - VBA Macro Warning settings</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-52800r1_rule" severity="medium" weight="10.0"><version>DTOO304</version><title>Warning Bar settings for VBA macros must be configured.</title><description>&lt;VulnDiscussion&gt;When users open files containing VBA Macros, applications open the files with the macros disabled and displays the Trust Bar with a warning that macros are present and have been disabled. Users may then enable these macros by clicking Options on the Trust Bar and selecting the option to enable them. Disabling or not configuring this setting may allow dangerous macros to become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Microsoft Visio 2013</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Microsoft Visio 2013</dc:subject><dc:identifier>2486</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-45726r1_fix">Set the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "VBA Macro Notification Settings" to "Enabled: Disable all with notification".</fixtext><fix id="F-45726r1_fix" /><check system="C-47129r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft Visio 2013.xml" /><check-content>Verify the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "VBA Macro Notification Settings" is set to "Enabled: Disable all with notification".
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
+
+HKCU\software\policies\Microsoft\office\15.0\Visio\security
+
+Criteria: If the value vbawarnings is REG_DWORD = 2, this is not a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/StigData/Archive/Office/U_MS_Word_2013_STIG_V1R6_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MS_Word_2013_STIG_V1R6_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_MS_Word_2013_STIG_V1R6_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_MS_Word_2013_STIG_V1R6_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.log b/source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R12_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.log b/source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.xml b/source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_MicrosoftOutlook2013_STIG_V1R13_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.log b/source/StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.xml b/source/StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.log b/source/StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_Microsoft_Outlook_2016_STIG_V1R2_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.log b/source/StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.xml b/source/StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_Microsoft_PowerPoint_2016_STIG_V1R1_Manual-xccdf.xml
diff --git a/StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.log b/source/StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.log
rename to source/StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.log
diff --git a/StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.xml b/source/StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.xml
rename to source/StigData/Archive/Office/U_Microsoft_Word_2016_STIG_V1R1_Manual-xccdf.xml
diff --git a/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log b/source/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log
rename to source/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log
diff --git a/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.xml b/source/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.xml
rename to source/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.xml
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R19_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R19_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R19_Manual-xccdf.xml
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R19_Manual-xccdf.xml
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R18_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R20_Manual-xccdf.xml
similarity index 82%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R18_Manual-xccdf.xml
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R20_Manual-xccdf.xml
index 490964115..d5b0c39dd 100644
--- a/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R18_Manual-xccdf.xml	
+++ b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Database_STIG_V1R20_Manual-xccdf.xml	
@@ -1,33 +1,33 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="MS_SQL_Server_2012_Database_Instance_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-01-08">accepted</status><title>Microsoft SQL Server 2012 Database Security Technical Implementation Guide</title><description>The Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 18 Benchmark Date: 25 Jan 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Group id="V-40911"><title>SRG-APP-000231-DB-000154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53265r5_rule" severity="medium" weight="10.0"><version>SQL2-00-021300</version><title>SQL Server must protect data at rest and ensure confidentiality and integrity of data.</title><description>&lt;VulnDiscussion&gt;This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information.  Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use.
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="MS_SQL_Server_Database_2012" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-01-16">accepted</status><title>Microsoft SQL Server Database 2012 Security Technical Implementation Guide</title><description>The Microsoft SQL Server 2012 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 20 Benchmark Date: 16 Jan 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40911" selected="true" /><select idref="V-41389" selected="true" /><select idref="V-41391" selected="true" /><select idref="V-41392" selected="true" /><select idref="V-41393" selected="true" /><select idref="V-41394" selected="true" /><select idref="V-41395" selected="true" /><select idref="V-41396" selected="true" /><select idref="V-41397" selected="true" /><select idref="V-41399" selected="true" /><select idref="V-41402" selected="true" /><select idref="V-41403" selected="true" /><select idref="V-41404" selected="true" /><select idref="V-41406" selected="true" /><select idref="V-41407" selected="true" /><select idref="V-41409" selected="true" /><select idref="V-41411" selected="true" /><select idref="V-41412" selected="true" /><select idref="V-41415" selected="true" /><select idref="V-41416" selected="true" /><select idref="V-41417" selected="true" /><select idref="V-41420" selected="true" /><select idref="V-41421" selected="true" /><select idref="V-41422" selected="true" /><select idref="V-41424" selected="true" /><select idref="V-60671" selected="true" /><select idref="V-60781" selected="true" /><select idref="V-70627" selected="true" /></Profile><Group id="V-40911"><title>SRG-APP-000231-DB-000154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53265r5_rule" severity="medium" weight="10.0"><version>SQL2-00-021300</version><title>SQL Server must protect data at rest and ensure confidentiality and integrity of data.</title><description>&lt;VulnDiscussion&gt;This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information.  Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use.
 
 User-generated data, as well as, application-specific configuration data, needs to be protected. Configurations and/or rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content are examples of system information likely requiring protection. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.
 
 If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.
 
-Protective measures include encryption, physical security of the facility where the storage devices reside, operating system file permissions, and organizational controls.  Each of these should be applied as necessary and appropriate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><fixtext fixref="F-46193r3_fix">Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. 
+Protective measures include encryption, physical security of the facility where the storage devices reside, operating system file permissions, and organizational controls.  Each of these should be applied as necessary and appropriate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><fixtext fixref="F-46193r3_fix">Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device.
 
 Where encryption is required, this can be done by full-disk encryption or by database encryption. To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on.
 
-Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).</fixtext><fix id="F-46193r3_fix" /><check system="C-47566r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding.
+Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).</fixtext><fix id="F-46193r3_fix" /><check system="C-47566r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding.
 
-If the application owner and Authorizing Official have determined that encryption of data at rest is required, 
+If the application owner and Authorizing Official have determined that encryption of data at rest is required,
 ensure the data on secondary devices is encrypted. If full-disk encryption is being used, this is not a finding.
 
 If DBMS data encryption is required, ensure the data is encrypted before being put on the secondary device by executing:
 
-SELECT 
+SELECT
     d.name AS [Database Name],
-    CASE e.encryption_state 
-        WHEN 0 THEN 'No database encryption key present, no encryption' 
-        WHEN 1 THEN 'Unencrypted' 
-        WHEN 2 THEN 'Encryption in progress' 
-        WHEN 3 THEN 'Encrypted' 
-        WHEN 4 THEN 'Key change in progress' 
-        WHEN 5 THEN 'Decryption in progress' 
-        WHEN 6 THEN 'Protection change in progress' 
+    CASE e.encryption_state
+        WHEN 0 THEN 'No database encryption key present, no encryption'
+        WHEN 1 THEN 'Unencrypted'
+        WHEN 2 THEN 'Encryption in progress'
+        WHEN 3 THEN 'Encrypted'
+        WHEN 4 THEN 'Key change in progress'
+        WHEN 5 THEN 'Decryption in progress'
+        WHEN 6 THEN 'Protection change in progress'
     END AS [Encryption State]
-FROM sys.dm_database_encryption_keys e 
-RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name 
+FROM sys.dm_database_encryption_keys e
+RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name
 WHERE d.name NOT IN ('master','model','msdb')
 ORDER BY 1
 ;
@@ -42,10 +42,10 @@ One example includes marking data as classified or FOUO. These security attribut
 
 The sensitivity marking or labeling of stored data items promotes the correct handling and protection of data.  Without such notification, the user may unwittingly disclose sensitive data to unauthorized users.
 
-(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002262</ident><fixtext fixref="F-46813r5_fix">Develop SQL or application code or acquire a third party tool to perform data labeling.</fixtext><fix id="F-46813r5_fix" /><check system="C-47925r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
+(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002262</ident><fixtext fixref="F-46813r5_fix">Develop SQL or application code or acquire a third party tool to perform data labeling.</fixtext><fix id="F-46813r5_fix" /><check system="C-47925r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool. Spot check data and ensure the appropriate labels have been applied to stored data.   
+Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool. Spot check data and ensure the appropriate labels have been applied to stored data.
 
 If the labeling of sensitive data is required and is not being performed, this is a finding.</check-content></check></Rule></Group><Group id="V-41391"><title>SRG-APP-000007-DB-000184</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53914r4_rule" severity="medium" weight="10.0"><version>SQL2-00-000400</version><title>SQL Server must maintain and support organization-defined security labels on information in process.</title><description>&lt;VulnDiscussion&gt;Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
 
@@ -57,11 +57,11 @@ If the application does not maintain the data security attributes when it transm
 
 The sensitivity marking or labeling of data items promotes the correct handling and protection of data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users. Security labels must be correctly maintained throughout transmission.
 
-(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002263</ident><fixtext fixref="F-46814r6_fix">Develop SQL or application code or acquire a third party tool to perform data labeling.</fixtext><fix id="F-46814r6_fix" /><check system="C-47926r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
+(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002263</ident><fixtext fixref="F-46814r6_fix">Develop SQL or application code or acquire a third party tool to perform data labeling.</fixtext><fix id="F-46814r6_fix" /><check system="C-47926r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.  
+Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.
 
 If the labeling of sensitive information in process is not being performed, this is a finding.</check-content></check></Rule></Group><Group id="V-41392"><title>SRG-APP-000008-DB-000185</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53916r4_rule" severity="medium" weight="10.0"><version>SQL2-00-000500</version><title>SQL Server must maintain and support organization-defined security labels on data in transmission.</title><description>&lt;VulnDiscussion&gt;Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
 
@@ -73,10 +73,10 @@ If the application does not maintain the data security attributes when it transm
 
 The sensitivity marking or labeling of data items promotes the correct handling and protection of data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users. Security labels must be correctly maintained throughout transmission.
 
-(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002264</ident><fixtext fixref="F-46816r4_fix">Develop SQL or application code or acquire a third party tool to perform data labeling.</fixtext><fix id="F-46816r4_fix" /><check system="C-47928r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
+(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002264</ident><fixtext fixref="F-46816r4_fix">Develop SQL or application code or acquire a third party tool to perform data labeling.</fixtext><fix id="F-46816r4_fix" /><check system="C-47928r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.  
+Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.
 
 If the labeling of sensitive data in transmission is not being performed, this is a finding.</check-content></check></Rule></Group><Group id="V-41393"><title>SRG-APP-000012-DB-000192</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53917r3_rule" severity="medium" weight="10.0"><version>SQL2-00-000900</version><title>SQL Server must allow authorized users to associate security labels to information in the database.</title><description>&lt;VulnDiscussion&gt;Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
 
@@ -84,7 +84,7 @@ These attributes are typically associated with internal data structures (e.g., r
 
 Examples of application security attributes are classified, FOUO, sensitive, etc.
 
-Throughout the course of normal usage, authorized users of applications that handle sensitive data will have the need to associate security attributes with information. Applications that maintain the binding of organization-defined security attributes to data must ensure authorized users can associate security attributes with information. For databases, this is accomplished via labeling.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002289</ident><fixtext fixref="F-46817r3_fix">Develop SQL code or acquire a third party tool to perform data labeling. SQL Server Label Security Toolkit can be downloaded from http://www.codeplex.com. This tool can satisfy all data labeling and security data labeling requirements.</fixtext><fix id="F-46817r3_fix" /><check system="C-47929r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
+Throughout the course of normal usage, authorized users of applications that handle sensitive data will have the need to associate security attributes with information. Applications that maintain the binding of organization-defined security attributes to data must ensure authorized users can associate security attributes with information. For databases, this is accomplished via labeling.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002289</ident><fixtext fixref="F-46817r3_fix">Develop SQL code or acquire a third party tool to perform data labeling. SQL Server Label Security Toolkit can be downloaded from http://www.codeplex.com. This tool can satisfy all data labeling and security data labeling requirements.</fixtext><fix id="F-46817r3_fix" /><check system="C-47929r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 If the labeling of sensitive data is not required, this is NA.
 
 Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool. Determine how authorized users associate security information to data. If authorized users are not able to associate security labels to data, this is a finding.</check-content></check></Rule></Group><Group id="V-41394"><title>SRG-APP-000085-DB-000038</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53918r3_rule" severity="medium" weight="10.0"><version>SQL2-00-011050</version><title>SQL Server utilizing Discretionary Access Control (DAC) must enforce a policy that limits propagation of access rights.</title><description>&lt;VulnDiscussion&gt;Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment.
@@ -97,10 +97,10 @@ The DBMS must ensure the recipient of object permissions possesses only the acce
 
 Correct each unapproved GRANT_WITH_GRANT_OPTION with REVOKE and GRANT statements of the form (replacing "UPDATE" with the actual permission at issue):
 REVOKE UPDATE ON SampleTable FROM SampleUserOrRole CASCADE;
-GRANT UPDATE ON SampleTable TO SampleRole;  -- Note, no WITH GRANT OPTION clause here.</fixtext><fix id="F-46818r4_fix" /><check system="C-47931r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check for rights propagation assignment to database permissions by running the following query:
+GRANT UPDATE ON SampleTable TO SampleRole;  -- Note, no WITH GRANT OPTION clause here.</fixtext><fix id="F-46818r4_fix" /><check system="C-47931r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check for rights propagation assignment to database permissions by running the following query:
 
 USE &lt;name of database being reviewed&gt;;
-SELECT * 
+SELECT *
 FROM sys.database_permissions
 WHERE state_desc = 'GRANT_WITH_GRANT_OPTION';
 
@@ -109,17 +109,17 @@ If any of the permissions listed have not been documented and approved as requir
 Developers granted elevated database and/or operating system privileges on production databases can affect the operation and/or security of the database system. Operating system and database privileges assigned to developers on production systems should not be allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002220</ident><fixtext fixref="F-46820r3_fix">Remove unnecessary developer accounts from SQL Server instances hosting only production databases, by running the following SQL script:
 
 USE master
-DROP LOGIN &lt;'account name'&gt;</fixtext><fix id="F-46820r3_fix" /><check system="C-47932r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check the list of SQL Server users against the list of developer accounts by running the following SQL Server query:
+DROP LOGIN &lt;'account name'&gt;</fixtext><fix id="F-46820r3_fix" /><check system="C-47932r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check the list of SQL Server users against the list of developer accounts by running the following SQL Server query:
 
 SELECT name AS 'Account Name'
      , create_date AS 'Account Create Date'
      , LOGINPROPERTY(name, 'PasswordLastSetTime') AS 'Password Last Set on'
 FROM sys.server_principals
-WHERE NOT TYPE IN ('C', 'R', 'U') 
+WHERE NOT TYPE IN ('C', 'R', 'U')
 AND NOT name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##')
 AND sid &lt;&gt; CONVERT(VARBINARY(85), 0x01) -- no 'sa' account
 AND is_disabled &lt;&gt; 1
-ORDER BY name; 
+ORDER BY name;
 
 For each developer account found on a production machine, verify if the developer account can change or alter database objects or data in the production database. If any developer account can change or alter database objects or data in a production database, this is a finding.</check-content></check></Rule></Group><Group id="V-41396"><title>SRG-APP-000062-DB-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53921r2_rule" severity="medium" weight="10.0"><version>SQL2-00-009300</version><title>SQL Server must be protected from unauthorized access by developers on shared production/development host systems.</title><description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
@@ -147,7 +147,7 @@ Remove 'Server Roles' permissions from accounts that are beyond what is required
 
 Navigate from 'Server Roles' to 'Users mapped to the login'.
 
-Remove 'Users mapped to the login' permissions from accounts that are beyond what is required.</fixtext><fix id="F-46821r2_fix" /><check system="C-47933r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Identify whether SQL Server contains both development and production databases from the system documentation.
+Remove 'Users mapped to the login' permissions from accounts that are beyond what is required.</fixtext><fix id="F-46821r2_fix" /><check system="C-47933r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Identify whether SQL Server contains both development and production databases from the system documentation.
 
 If SQL Server is not hosting both production and development databases, this is NA.
 
@@ -196,7 +196,7 @@ Remove 'Server roles' by clicking the appropriate check box.
 
 The special database principal [dbo] is an exception.  It is mapped to the server login that is the database owner.  Some roles cannot be mapped to it or unmapped from it.
 
-The built-in server role "sysadmin" is a partial exception.  See the Vulnerability Discussion.</fixtext><fix id="F-46822r5_fix" /><check system="C-47934r9_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check administrative accounts for direct database role membership:
+The built-in server role "sysadmin" is a partial exception.  See the Vulnerability Discussion.</fixtext><fix id="F-46822r5_fix" /><check system="C-47934r9_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check administrative accounts for direct database role membership:
 
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'administrator account name'&gt; &gt;&gt; Properties &gt;&gt; User Mapping &gt;&gt; &lt;'highlight database'&gt; &gt;&gt; review 'Database role membership' for each database.
 
@@ -214,11 +214,11 @@ The built-in server role "sysadmin" is a partial exception.  See the Vulnerabili
 
 If SQL Server were to allow any user to make SQL Server job/batch queue submissions, then those submissions might lead to a compromise of system integrity and/or data. This requirement is contingent upon the SQL Server job/batch queue being review regularly for unauthorized submissions.
 
-Accordingly, only qualified and authorized individuals shall be allowed to obtain access to submit SQL Server jobs. Job/batch queue submissions must adhere to an organization-defined job submission process. 
+Accordingly, only qualified and authorized individuals shall be allowed to obtain access to submit SQL Server jobs. Job/batch queue submissions must adhere to an organization-defined job submission process.
 
 Unmanaged changes that occur to SQL Server job/batch queues can lead to a compromised system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46825r2_fix">Document procedures, within the system documentation, that detect for unauthorized SQL Server job submissions.
 
-Develop and implement procedures to detect for unauthorized SQL Server job submissions of Stored Procedures that are automatically executed and Agent jobs that are enabled.</fixtext><fix id="F-46825r2_fix" /><check system="C-47937r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check system documentation for procedures that are regularly implemented in an effort to detect unauthorized SQL Server job submissions.
+Develop and implement procedures to detect for unauthorized SQL Server job submissions of Stored Procedures that are automatically executed and Agent jobs that are enabled.</fixtext><fix id="F-46825r2_fix" /><check system="C-47937r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check system documentation for procedures that are regularly implemented in an effort to detect unauthorized SQL Server job submissions.
 
 If procedures that are regularly implemented are not documented in the system documentation, this is a finding.
 
@@ -229,37 +229,37 @@ SELECT name
   FROM master.sys.procedures
  WHERE is_auto_executed = 1
 
-If any Stored Procedures listed are not documented as authorized, this is a finding.  
+If any Stored Procedures listed are not documented as authorized, this is a finding.
 
 Review the SQL Server job history by running the following query:
 
-SELECT *   FROM msdb.dbo.sysjobhistory 
+SELECT *   FROM msdb.dbo.sysjobhistory
 
 
 If any jobs listed are not documented as authorized, this is a finding.</check-content></check></Rule></Group><Group id="V-41402"><title>SRG-APP-000089-DB-000064</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53928r4_rule" severity="medium" weight="10.0"><version>SQL2-00-011200</version><title>SQL Server must provide audit record generation capability for organization-defined auditable events within the database.</title><description>&lt;VulnDiscussion&gt;Audit records can be generated from various components within the information system (e.g., network interface, hard disk, modem, etc.). From an application perspective, certain specific application functionalities may be audited as well.
 
 The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.  Examples are auditable events, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
-Organizations define which application components shall provide auditable events. 
+Organizations define which application components shall provide auditable events.
 
 The DBMS must provide auditing for the list of events defined by the organization or risk negatively impacting forensic investigations into malicious behavior in the information system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000169</ident><fixtext fixref="F-46828r6_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46828r6_fix" /><check system="C-47940r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46828r6_fix" /><check system="C-47940r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -267,9 +267,9 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41403"><title>SRG-APP-000133-DB-000179</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53930r4_rule" severity="medium" weight="10.0"><version>SQL2-00-014900</version><title>SQL Server must be monitored to discover unauthorized changes to functions.</title><description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant effects on the overall security of the system.
 
@@ -279,9 +279,9 @@ This requirement is contingent upon the language in which the application is pro
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to SQL Server components for purposes of initiating changes, including upgrades and modifications.
 
-Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Functions, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46831r2_fix">Configure a SQL Server timed job that automatically checks all system and user-defined Functions for being modified. 
+Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Functions, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46831r2_fix">Configure a SQL Server timed job that automatically checks all system and user-defined Functions for being modified.
 
-(The supplemental file Track.sql, provided with this STIG, can be used to establish a monitoring job.  This should be supplemented with a process for informing the appropriate personnel.  Other techniques for achieving the same ends, such as the use of DDL triggers, are acceptable.)</fixtext><fix id="F-46831r2_fix" /><check system="C-47941r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check the SQL Server configuration for a timed job that automatically checks all system and user-defined Functions for being modified by running the following SQL Server query:
+(The supplemental file Track.sql, provided with this STIG, can be used to establish a monitoring job.  This should be supplemented with a process for informing the appropriate personnel.  Other techniques for achieving the same ends, such as the use of DDL triggers, are acceptable.)</fixtext><fix id="F-46831r2_fix" /><check system="C-47941r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check the SQL Server configuration for a timed job that automatically checks all system and user-defined Functions for being modified by running the following SQL Server query:
 EXEC msdb.dbo.sp_help_job  @job_name = '&lt;enter . . . job name&gt;';
 
 (Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)
@@ -296,7 +296,7 @@ Accordingly, only qualified and authorized individuals shall be allowed to obtai
 
 Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Triggers, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46832r2_fix">Configure a SQL Server timed job that automatically checks all system and user-defined Triggers for modification.
 
-(The supplemental file Track.sql, provided with this STIG, can be used to establish a monitoring job.  This should be supplemented with a process for informing the appropriate personnel.  Other techniques for achieving the same ends, such as the use of DDL triggers, are acceptable.)</fixtext><fix id="F-46832r2_fix" /><check system="C-47942r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check the SQL Server configuration for the timed job that automatically checks all system and user-defined Triggers for being modified by running the following SQL Server query:
+(The supplemental file Track.sql, provided with this STIG, can be used to establish a monitoring job.  This should be supplemented with a process for informing the appropriate personnel.  Other techniques for achieving the same ends, such as the use of DDL triggers, are acceptable.)</fixtext><fix id="F-46832r2_fix" /><check system="C-47942r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check the SQL Server configuration for the timed job that automatically checks all system and user-defined Triggers for being modified by running the following SQL Server query:
 EXEC msdb.dbo.sp_help_job  @job_name = '&lt;enter . . . job name&gt;';
 
 (Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)
@@ -309,9 +309,9 @@ This requirement is contingent upon the language in which the application is pro
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to SQL Server components for purposes of initiating changes, including upgrades and modifications.
 
-Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Stored Procedures, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46833r2_fix">Configure a SQL Server timed job that automatically checks all system and user-defined Stored Procedures for modification.  
+Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Stored Procedures, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46833r2_fix">Configure a SQL Server timed job that automatically checks all system and user-defined Stored Procedures for modification.
 
-(The supplemental file Track.sql, provided with this STIG, can be used to establish a monitoring job.  This should be supplemented with a process for informing the appropriate personnel.  Other techniques for achieving the same ends, such as the use of DDL triggers, are acceptable.)</fixtext><fix id="F-46833r2_fix" /><check system="C-47943r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check for the existence of a job to monitor for changes to stored procedures:
+(The supplemental file Track.sql, provided with this STIG, can be used to establish a monitoring job.  This should be supplemented with a process for informing the appropriate personnel.  Other techniques for achieving the same ends, such as the use of DDL triggers, are acceptable.)</fixtext><fix id="F-46833r2_fix" /><check system="C-47943r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check for the existence of a job to monitor for changes to stored procedures:
 EXEC msdb.dbo.sp_help_job  @job_name = '&lt;enter . . . job name&gt;';
 
 (Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)
@@ -323,7 +323,7 @@ Within the database, object ownership implies full privileges to the owned objec
 Reassign database ownership to authorized database owner account:
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Databases &gt;&gt; right click &lt;'database name'&gt; &gt;&gt; Properties &gt;&gt; Files.
 Select new database "Owner":
-Navigate to click on […] &gt;&gt; Select new Database Owner &gt;&gt; Browse… &gt;&gt; click on box to indicate account &gt;&gt; &lt;'OK'&gt; &gt;&gt; &lt;'OK'&gt; &gt;&gt; &lt;'OK'&gt;</fixtext><fix id="F-46835r2_fix" /><check system="C-47945r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review system documentation to identify SQL Server accounts authorized to own database objects.
+Navigate to click on […] &gt;&gt; Select new Database Owner &gt;&gt; Browse… &gt;&gt; click on box to indicate account &gt;&gt; &lt;'OK'&gt; &gt;&gt; &lt;'OK'&gt; &gt;&gt; &lt;'OK'&gt;</fixtext><fix id="F-46835r2_fix" /><check system="C-47945r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review system documentation to identify SQL Server accounts authorized to own database objects.
 
 If the SQL Server database ownership list does not exist or needs to be updated, this is a finding.
 
@@ -338,7 +338,7 @@ It is detrimental for applications to provide or install by default, functionali
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
-Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46837r2_fix">If any database components or objects of SQL Server are required for operation of applications that will be accessing SQL Server data or configuration, include them in the system documentation. If any unused components or objects of SQL Server are installed, uninstall or remove unused components or objects.</fixtext><fix id="F-46837r2_fix" /><check system="C-47946r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review the list of components or optional features installed with SQL Server.
+Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46837r2_fix">If any database components or objects of SQL Server are required for operation of applications that will be accessing SQL Server data or configuration, include them in the system documentation. If any unused components or objects of SQL Server are installed, uninstall or remove unused components or objects.</fixtext><fix id="F-46837r2_fix" /><check system="C-47946r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review the list of components or optional features installed with SQL Server.
 If optional features or components are NOT installed, this is not a finding.
 
 If unused components or features of SQL Server are installed, then review the system documentation to verify unused components or features are documented and authorized.
@@ -366,12 +366,12 @@ CREATE CERTIFICATE &lt;'certificate name'&gt;
 Run the following SQL script to create a symmetric key and assign an existing certificate:
 USE &lt;'database name'&gt;
 CREATE SYMMETRIC KEY &lt;'key name'&gt;
-   WITH ALGORITHM = AES_256 
+   WITH ALGORITHM = AES_256
    ENCRYPTION BY &lt;'certificate name'&gt;
 
 Set SQL Server configuration settings to encrypt databases, tables, columns, and/or data elements as required by the organization and the system owner.
 
-Document all instances of acceptance of risk by the information owner where sensitive or classified data is not encrypted. Have the ISSO document assurance that the unencrypted sensitive or classified information is otherwise inaccessible to those who do not have need-to-know access to the data. Developers should consider using a record-specific encryption method to protect individual records. For example, by employing the session username or other individualized element as part of the encryption key, then decryption of a data element is only possible by that user or other data accessible only by that user. Data labeling can be helpful in implementation. Consider applying additional auditing of access to any unencrypted sensitive or classified data when accessed by users (with and/or without a need to know).</fixtext><fix id="F-46838r4_fix" /><check system="C-47947r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review SQL Server's cryptographic settings to determine whether data stored in databases is encrypted according to organizational requirements and the system owner.
+Document all instances of acceptance of risk by the information owner where sensitive or classified data is not encrypted. Have the ISSO document assurance that the unencrypted sensitive or classified information is otherwise inaccessible to those who do not have need-to-know access to the data. Developers should consider using a record-specific encryption method to protect individual records. For example, by employing the session username or other individualized element as part of the encryption key, then decryption of a data element is only possible by that user or other data accessible only by that user. Data labeling can be helpful in implementation. Consider applying additional auditing of access to any unencrypted sensitive or classified data when accessed by users (with and/or without a need to know).</fixtext><fix id="F-46838r4_fix" /><check system="C-47947r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review SQL Server's cryptographic settings to determine whether data stored in databases is encrypted according to organizational requirements and the system owner.
 
 If all of the data on SQL Server is unclassified and encryption of information is not required, this requirement is NA.
 
@@ -452,8 +452,8 @@ GO
 Run the following SQL to create a database encryption key and encrypt the database:
 USE &lt;database name&gt;;
 GO
-CREATE DATABASE ENCRYPTION KEY 
-   WITH ALGORITHM = AES_256 
+CREATE DATABASE ENCRYPTION KEY
+   WITH ALGORITHM = AES_256
    ENCRYPTION BY SERVER CERTIFICATE &lt;certificate name&gt;;
 GO
 USE master;
@@ -467,20 +467,20 @@ If required, run the following SQL to create a symmetric key and assign an exist
 USE &lt;database name&gt;;
 GO
 CREATE SYMMETRIC KEY &lt;key name&gt;
-   WITH ALGORITHM = AES_256 
+   WITH ALGORITHM = AES_256
    ENCRYPTION BY CERTIFICATE &lt;certificate name&gt;;
-</fixtext><fix id="F-46839r9_fix" /><check system="C-47949r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>If encryption is not required for this database, this is not a finding.
+</fixtext><fix id="F-46839r9_fix" /><check system="C-47949r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>If encryption is not required for this database, this is not a finding.
 
 Run the following SQL queries to review SQL Server's cryptographic settings for the database:
 
 USE &lt;database name&gt; ;
 IF NOT EXISTS
        (
-       SELECT 1 
+       SELECT 1
        FROM sys.dm_database_encryption_keys
        WHERE DB_NAME(database_id) = DB_NAME()
        )
-       SELECT 
+       SELECT
              DB_NAME() AS [Database Name],
              'No database encryption key present, no encryption' AS [Encryption State],
                      NULL AS [Algorithm],
@@ -488,22 +488,22 @@ IF NOT EXISTS
 ELSE
        SELECT
              DB_NAME(database_id) AS [Database Name],
-             CASE encryption_state 
-                   WHEN 0 THEN 'No database encryption key present, no encryption' 
-                   WHEN 1 THEN 'Unencrypted' 
-                   WHEN 2 THEN 'Encryption in progress' 
-                   WHEN 3 THEN 'Encrypted' 
-                   WHEN 4 THEN 'Key change in progress' 
-                   WHEN 5 THEN 'Decryption in progress' 
-                   WHEN 6 THEN 'Protection change in progress' 
+             CASE encryption_state
+                   WHEN 0 THEN 'No database encryption key present, no encryption'
+                   WHEN 1 THEN 'Unencrypted'
+                   WHEN 2 THEN 'Encryption in progress'
+                   WHEN 3 THEN 'Encrypted'
+                   WHEN 4 THEN 'Key change in progress'
+                   WHEN 5 THEN 'Decryption in progress'
+                   WHEN 6 THEN 'Protection change in progress'
              END AS [Encryption State],
                      key_algorithm AS [Algorithm],
                      key_length AS [Key Length]
        FROM sys.dm_database_encryption_keys
        WHERE DB_NAME(database_id) = DB_NAME()
 
-SELECT DB_NAME() AS [Database], name, algorithm_desc 
-FROM sys.symmetric_keys 
+SELECT DB_NAME() AS [Database], name, algorithm_desc
+FROM sys.symmetric_keys
 ORDER BY name, algorithm_desc;
 
 Note:  The acceptable algorithms are:  "AES 128", "AES 192", "AES 256" and "Triple DES".
@@ -511,7 +511,7 @@ Note:  The acceptable algorithms are:  "AES 128", "AES 192", "AES 256" and "Trip
 If SQL Server cryptographic algorithms are not listed or are found not to be compliant with applicable federal laws, Executive Orders, directives, policies, regulations, standards and guidance, this is a finding.
 
 If the encryption state indicates that the database is unencrypted, this is a finding.</check-content></check></Rule></Group><Group id="V-41415"><title>SRG-APP-000231-DB-000154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53944r3_rule" severity="medium" weight="10.0"><version>SQL2-00-024100</version><title>The Database Master Key must be encrypted by the Service Master Key where required.</title><description>&lt;VulnDiscussion&gt;When not encrypted by the Service Master Key, system administrators or application administrators may access and use the Database Master Key to view sensitive data that they are not authorized to view. Where alternate encryption means are not feasible, encryption by the Service Master Key may be necessary. To help protect sensitive data from unauthorized access by DBAs, mitigations may be in order. Mitigations may include automatic alerts or other audit events when the Database Master Key is accessed outside of the application or by a DBA account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><fixtext fixref="F-46843r2_fix">Where possible, encrypt the Database Master Key with a password known only to the application administrator.
-Where not possible, configure additional audit events or alerts to detect unauthorized access to the Database Master Key by users not authorized to view sensitive data.</fixtext><fix id="F-46843r2_fix" /><check system="C-47951r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>From the query prompt:
+Where not possible, configure additional audit events or alerts to detect unauthorized access to the Database Master Key by users not authorized to view sensitive data.</fixtext><fix id="F-46843r2_fix" /><check system="C-47951r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>From the query prompt:
 SELECT name
 FROM [master].sys.databases
 WHERE is_master_key_encrypted_by_server = 1
@@ -528,7 +528,7 @@ data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;Fal
 store Database Master Key passwords.
 From the query prompt:
 EXEC SP_CONTROL_DBMASTERKEY_PASSWORD @db_name = '[database name]', @action
-= N'drop'</fixtext><fix id="F-46845r2_fix" /><check system="C-47952r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>From the query prompt:
+= N'drop'</fixtext><fix id="F-46845r2_fix" /><check system="C-47952r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>From the query prompt:
 SELECT COUNT(credential_id)
 FROM [master].sys.master_key_passwords
 
@@ -537,7 +537,7 @@ From the query prompt:
 ALTER SYMMETRIC KEY [key name] ADD ENCRYPTION BY CERTIFICATE [certificate name]
 ALTER SYMMETRIC KEY [key name] DROP ENCRYPTION BY [password, symmetric key or asymmetric key]
 
-The symmetric key must specify a certificate or asymmetric key for encryption.</fixtext><fix id="F-46846r4_fix" /><check system="C-47953r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>In a query tool:
+The symmetric key must specify a certificate or asymmetric key for encryption.</fixtext><fix id="F-46846r4_fix" /><check system="C-47953r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>In a query tool:
 USE &lt;database name&gt;;
 GO
 SELECT s.name, k.crypt_type_desc
@@ -558,7 +558,7 @@ If the certificate specified is not a DoD PKI certificate, this is a finding.</c
 
 Note:  the system databases (master, msdb, model, resource and tempdb) cannot be encrypted.
 
-The decision whether to employ cryptography is the responsibility of the information owner/steward, who exercises discretion within the framework of applicable rules, policies and law.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002476</ident><fixtext fixref="F-46848r3_fix">Use encryption to protect the data. To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on.</fixtext><fix id="F-46848r3_fix" /><check system="C-47955r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>If this is a system database (master, msdb, resource, tempdb or model), this is not applicable (NA).
+The decision whether to employ cryptography is the responsibility of the information owner/steward, who exercises discretion within the framework of applicable rules, policies and law.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002476</ident><fixtext fixref="F-46848r3_fix">Use encryption to protect the data. To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on.</fixtext><fix id="F-46848r3_fix" /><check system="C-47955r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>If this is a system database (master, msdb, resource, tempdb or model), this is not applicable (NA).
 
 If the application owner and authorizing official have determined that the database does not require encryption, this is not a finding.
 
@@ -566,25 +566,25 @@ Ensure the data is encrypted by executing:
 USE &lt;database name&gt;;
 IF NOT EXISTS
     (
-    SELECT 1 
+    SELECT 1
     FROM sys.dm_database_encryption_keys
     WHERE DB_NAME(database_id) = DB_NAME()
     )
-    SELECT 
+    SELECT
         DB_NAME() AS [Database Name],
         'No database encryption key present, no encryption' AS [Encryption State]
 ELSE
     SELECT
         DB_NAME(database_id)  AS [Database Name],
-        CASE encryption_state 
-            WHEN 0 THEN 'No database encryption key present, no encryption' 
-            WHEN 1 THEN 'Unencrypted' 
-            WHEN 2 THEN 'Encryption in progress' 
-            WHEN 3 THEN 'Encrypted' 
-            WHEN 4 THEN 'Key change in progress' 
-            WHEN 5 THEN 'Decryption in progress' 
-            WHEN 6 THEN 'Protection change in progress' 
-        END AS [Encryption State] 
+        CASE encryption_state
+            WHEN 0 THEN 'No database encryption key present, no encryption'
+            WHEN 1 THEN 'Unencrypted'
+            WHEN 2 THEN 'Encryption in progress'
+            WHEN 3 THEN 'Encrypted'
+            WHEN 4 THEN 'Key change in progress'
+            WHEN 5 THEN 'Decryption in progress'
+            WHEN 6 THEN 'Protection change in progress'
+        END AS [Encryption State]
     FROM sys.dm_database_encryption_keys
     WHERE DB_NAME(database_id) = DB_NAME()
 ;
@@ -593,7 +593,7 @@ For each user database, ensure that encryption is in effect.  If not, this is a
 
 Data used for the development and testing of applications often involves copying data from production. It is important that specific procedures exist for this process, so copies of sensitive data are not misplaced or left in a temporary location without the proper controls.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001090</ident><fixtext fixref="F-46850r2_fix">Create and document a process for moving data from production to development/test systems and follow the process.
 
-Modify any code used for moving data from production to development/test systems to ensure copies of production data are not left in unsecured locations.</fixtext><fix id="F-46850r2_fix" /><check system="C-47956r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Verify there are proper procedures in place for the transfer of development/test data from production. Review any scripts or code that exists for the movement of production data to development/test and verify copies of production data are not left in unprotected locations.
+Modify any code used for moving data from production to development/test systems to ensure copies of production data are not left in unsecured locations.</fixtext><fix id="F-46850r2_fix" /><check system="C-47956r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Verify there are proper procedures in place for the transfer of development/test data from production. Review any scripts or code that exists for the movement of production data to development/test and verify copies of production data are not left in unprotected locations.
 
 If there is no documented procedure for data movement from production to development/test, this is a finding.
 
@@ -614,7 +614,7 @@ EXEC sys.sp_configure N'show advanced options', N'1'  RECONFIGURE WITH OVERRIDE
 GO
 EXEC sys.sp_configure N'user connections', &lt;'maximum number of SQL Server concurrent connections'&gt;
 EXEC sys.sp_configure N'show advanced options', N'0'  RECONFIGURE WITH OVERRIDE
-GO</fixtext><fix id="F-46851r2_fix" /><check system="C-47957r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Check SQL Server settings for the number of concurrent Check SQL Server settings for the number of concurrent sessions by running the following script:
+GO</fixtext><fix id="F-46851r2_fix" /><check system="C-47957r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Check SQL Server settings for the number of concurrent Check SQL Server settings for the number of concurrent sessions by running the following script:
 
 USE MASTER
 GO
@@ -633,7 +633,7 @@ A poorly designed database system can have many problems. A common issue with th
 
 While this matter is of great importance to the secure operation of database management systems, the DBA in a typical installation will communicate with the application development/support staff to obtain assurance that this requirement is met.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001310</ident><fixtext fixref="F-46852r2_fix">Use triggers, constraints, foreign keys, etc. to validate data input.
 
-Modify SQL Server to properly use the correct column data types as required in the database.</fixtext><fix id="F-46852r2_fix" /><check system="C-47958r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review SQL Server field definitions, constraints, and foreign keys to determine whether or not data being input into the database is valid.
+Modify SQL Server to properly use the correct column data types as required in the database.</fixtext><fix id="F-46852r2_fix" /><check system="C-47958r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review SQL Server field definitions, constraints, and foreign keys to determine whether or not data being input into the database is valid.
 If field definitions are not reflective of the data, this is a finding.
 
 If column data types are not assigned correctly where required within the database, this is a finding.
@@ -653,24 +653,24 @@ Therefore, TRUSTWORTHY must not be used on databases owned by logins that are me
 The system database [msdb] is an exception: it is required to be TRUSTWORTHY.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-66461r1_fix">USE [master];
 GO
 ALTER DATABASE &lt;name&gt; SET TRUSTWORTHY OFF;
-GO</fixtext><fix id="F-66461r1_fix" /><check system="C-61703r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>If the database is owned by an account that is directly or indirectly a member of a fixed (built-in) server role, this is not applicable (NA).
+GO</fixtext><fix id="F-66461r1_fix" /><check system="C-61703r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>If the database is owned by an account that is directly or indirectly a member of a fixed (built-in) server role, this is not applicable (NA).
 
 Run the query:
 USE &lt;database name&gt;;
 GO
-SELECT 
-       DB_NAME()                  AS [Database], 
-       SUSER_SNAME(D.owner_sid)   AS [Database Owner], 
+SELECT
+       DB_NAME()                  AS [Database],
+       SUSER_SNAME(D.owner_sid)   AS [Database Owner],
        CASE WHEN D.is_trustworthy_on = 1 THEN 'ON' ELSE 'off' END
                                   AS [Trustworthy]
 FROM
-       sys.databases D 
+       sys.databases D
 WHERE
        D.[name] = DB_NAME()
 AND    DB_NAME() &lt;&gt; 'msdb'
 AND    D.is_trustworthy_on = 1;
 GO
-If the query returns a row indicating that the TRUSTWORTHY setting is OFF, or returns no rows, this is not a finding. 
+If the query returns a row indicating that the TRUSTWORTHY setting is OFF, or returns no rows, this is not a finding.
 
 Review the system security plan to determine whether the need for TRUSTWORTHY is documented and approved.  If not, this is a finding.</check-content></check></Rule></Group><Group id="V-60781"><title>SRG-APP-000133-DB-000200</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-75233r1_rule" severity="medium" weight="10.0"><version>SQL2-00-015610</version><title>In a database owned by [sa], or by any other login having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF.</title><description>&lt;VulnDiscussion&gt;SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if misused, so their use must be tightly controlled.
 
@@ -701,7 +701,7 @@ USE &lt;database name&gt;;
 GO
 WITH C AS
 (
-SELECT 
+SELECT
     P.name        AS [Parent Server Role],
     CAST('Fixed' AS varchar(8))
                 AS [Server Role Type],
@@ -716,7 +716,7 @@ FROM
 WHERE
     P.is_fixed_role = 1
 UNION ALL
-SELECT 
+SELECT
     P.name        AS [Parent Server Role],
     CASE WHEN M.is_fixed_role = 1 THEN CAST('Fixed' AS varchar(8)) ELSE CAST('Custom' AS varchar(8)) END
                 AS [Server Role Type],
@@ -733,7 +733,7 @@ FROM
 ,
 B AS
 (
-SELECT 
+SELECT
     C.[Member] AS [Leaf],
     C.[Root],
     C.[Parent Server Role],
@@ -741,11 +741,11 @@ SELECT
     C.[Member],
     C.[Member Type],
     C.[Level]
-FROM C 
+FROM C
 WHERE
     C.[Member Type] NOT LIKE '%ROLE%'
 UNION ALL
-SELECT  
+SELECT
     B.[Leaf],
     C.[Root],
     C.[Parent Server Role],
@@ -760,7 +760,7 @@ INNER JOIN B
     AND    C.[Root] = B.[Root]
 )
 SELECT
-    DB_NAME()    AS [Database],  
+    DB_NAME()    AS [Database],
     B.[Leaf]    AS [Owner Login],
     B.[Root]    AS[Top-Level Server Role],
     B.[Parent Server Role],
@@ -768,7 +768,7 @@ SELECT
     B.[Member],
     B.[Member Type],
     B.[Level]
-FROM B 
+FROM B
 WHERE B.[Leaf] = (SELECT SUSER_SNAME(D.owner_sid) FROM sys.databases D WHERE D.Name = DB_NAME())
 ORDER BY B.[Root], B.[Level], B.[Parent Server Role], B.[Member]
 ;
@@ -788,7 +788,7 @@ USE [master];
 GO
 ALTER AUTHORIZATION ON DATABASE::&lt;DB name&gt; TO &lt;new owner name&gt;;
 GO
-Verify that this produced the intended result by re-running the Check query.</fixtext><fix id="F-66463r5_fix" /><check system="C-61705r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>USE &lt;database name&gt;;
+Verify that this produced the intended result by re-running the Check query.</fixtext><fix id="F-66463r5_fix" /><check system="C-61705r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>USE &lt;database name&gt;;
 GO
 WITH FixedServerRoles(RoleName) AS
 (
@@ -801,23 +801,23 @@ WITH FixedServerRoles(RoleName) AS
     UNION SELECT 'dbcreator'
     UNION SELECT 'bulkadmin'
 )
-SELECT 
-    DB_NAME() AS [Database], 
-    SUSER_SNAME(D.owner_sid) AS [Database Owner], 
+SELECT
+    DB_NAME() AS [Database],
+    SUSER_SNAME(D.owner_sid) AS [Database Owner],
     F.RoleName AS [Fixed Server Role],
     CASE WHEN D.is_trustworthy_on = 1 THEN 'ON' ELSE 'off' END
-        AS [Trustworthy]    
+        AS [Trustworthy]
 FROM
     FixedServerRoles F
     INNER JOIN sys.databases D ON D.Name = DB_NAME()
-WHERE 
+WHERE
     IS_SRVROLEMEMBER(F.RoleName, SUSER_SNAME(D.owner_sid)) = 1
 AND    DB_NAME()  &lt;&gt;  'msdb'
 AND    D.is_trustworthy_on = 1;
 GO
 If the query returns any rows, this is a finding.  </check-content></check></Rule></Group><Group id="V-70627"><title> SRG-APP-000144-DB-000101</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-85249r2_rule" severity="low" weight="10.0"><version>SQL2-00-017510</version><title>Appropriate staff must be alerted when the amount of storage space used by the SQL Server transaction log file(s) exceeds an organization-defined value.</title><description>&lt;VulnDiscussion&gt;It is important for the appropriate personnel to be aware if the system is at risk of failing to record transaction log data.  The transaction log is the heart of a SQL Server database.  If it fails, processing will stop.  It must always have enough available storage space to cope with peak load.  Administrators must be warned about abnormally high space consumption soon enough to take corrective action before all space is used up.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Database 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Database 2012</dc:subject><dc:identifier>2560</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000553</ident><fixtext fixref="F-77185r1_fix">Decide on, and document, the threshold value for alerting administrators to a shortage of storage for the transaction log.
 
-Establish automated or manual monitoring and alerting.</fixtext><fix id="F-77185r1_fix" /><check system="C-71297r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server 2012 Database Instance STIG.xml" /><check-content>Review system documentation and/or organizational procedures to determine the threshold value for the storage used by the transaction log, above which staff must be alerted.  The threshold may be expressed as an absolute quantity, or a percentage of total available space.
+Establish automated or manual monitoring and alerting.</fixtext><fix id="F-77185r1_fix" /><check system="C-71297r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Database 2012.xml" /><check-content>Review system documentation and/or organizational procedures to determine the threshold value for the storage used by the transaction log, above which staff must be alerted.  The threshold may be expressed as an absolute quantity, or a percentage of total available space.
 
 If this threshold has not been defined, this is a finding.
 
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.log b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.log
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.log
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.xml
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2012_Instance_STIG_V1R19_Manual-xccdf.xml
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.log b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.log
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.log
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.xml
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R8_Manual-xccdf.xml
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R9_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R9_Manual-xccdf.log
diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R9_Manual-xccdf.xml
similarity index 97%
rename from StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.xml
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R9_Manual-xccdf.xml
index 715e652cb..849c64dc9 100644
--- a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.xml	
+++ b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R9_Manual-xccdf.xml	
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="MS_SQL_Server_2016_Instance_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-09-27">accepted</status><title>MS SQL Server 2016 Instance Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 7 Benchmark Date: 25 Oct 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Group id="V-79119"><title>SRG-APP-000001-DB-000031</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93825r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-003600</version><title>SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.</title><description>&lt;VulnDiscussion&gt;Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks.
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="MS_SQL_Server_2016_Instance_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-12">accepted</status><title>MS SQL Server 2016 Instance Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 9 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-79119" selected="true" /><select idref="V-79121" selected="true" /><select idref="V-79123" selected="true" /><select idref="V-79125" selected="true" /><select idref="V-79127" selected="true" /><select idref="V-79129" selected="true" /><select idref="V-79131" selected="true" /><select idref="V-79133" selected="true" /><select idref="V-79135" selected="true" /><select idref="V-79137" selected="true" /><select idref="V-79139" selected="true" /><select idref="V-79141" selected="true" /><select idref="V-79145" selected="true" /><select idref="V-79147" selected="true" /><select idref="V-79149" selected="true" /><select idref="V-79151" selected="true" /><select idref="V-79153" selected="true" /><select idref="V-79155" selected="true" /><select idref="V-79157" selected="true" /><select idref="V-79159" selected="true" /><select idref="V-79161" selected="true" /><select idref="V-79163" selected="true" /><select idref="V-79165" selected="true" /><select idref="V-79167" selected="true" /><select idref="V-79169" selected="true" /><select idref="V-79171" selected="true" /><select idref="V-79173" selected="true" /><select idref="V-79175" selected="true" /><select idref="V-79177" selected="true" /><select idref="V-79179" selected="true" /><select idref="V-79181" selected="true" /><select idref="V-79183" selected="true" /><select idref="V-79185" selected="true" /><select idref="V-79187" selected="true" /><select idref="V-79189" selected="true" /><select idref="V-79191" selected="true" /><select idref="V-79193" selected="true" /><select idref="V-79195" selected="true" /><select idref="V-79197" selected="true" /><select idref="V-79199" selected="true" /><select idref="V-79201" selected="true" /><select idref="V-79203" selected="true" /><select idref="V-79205" selected="true" /><select idref="V-79207" selected="true" /><select idref="V-79209" selected="true" /><select idref="V-79211" selected="true" /><select idref="V-79213" selected="true" /><select idref="V-79215" selected="true" /><select idref="V-79217" selected="true" /><select idref="V-79219" selected="true" /><select idref="V-79221" selected="true" /><select idref="V-79223" selected="true" /><select idref="V-79225" selected="true" /><select idref="V-79227" selected="true" /><select idref="V-79229" selected="true" /><select idref="V-79231" selected="true" /><select idref="V-79233" selected="true" /><select idref="V-79235" selected="true" /><select idref="V-79237" selected="true" /><select idref="V-79239" selected="true" /><select idref="V-79241" selected="true" /><select idref="V-79243" selected="true" /><select idref="V-79245" selected="true" /><select idref="V-79247" selected="true" /><select idref="V-79249" selected="true" /><select idref="V-79251" selected="true" /><select idref="V-79253" selected="true" /><select idref="V-79255" selected="true" /><select idref="V-79257" selected="true" /><select idref="V-79259" selected="true" /><select idref="V-79261" selected="true" /><select idref="V-79263" selected="true" /><select idref="V-79265" selected="true" /><select idref="V-79267" selected="true" /><select idref="V-79269" selected="true" /><select idref="V-79271" selected="true" /><select idref="V-79273" selected="true" /><select idref="V-79275" selected="true" /><select idref="V-79277" selected="true" /><select idref="V-79279" selected="true" /><select idref="V-79281" selected="true" /><select idref="V-79283" selected="true" /><select idref="V-79285" selected="true" /><select idref="V-79287" selected="true" /><select idref="V-79289" selected="true" /><select idref="V-79291" selected="true" /><select idref="V-79293" selected="true" /><select idref="V-79295" selected="true" /><select idref="V-79297" selected="true" /><select idref="V-79299" selected="true" /><select idref="V-79301" selected="true" /><select idref="V-79303" selected="true" /><select idref="V-79305" selected="true" /><select idref="V-79307" selected="true" /><select idref="V-79309" selected="true" /><select idref="V-79311" selected="true" /><select idref="V-79313" selected="true" /><select idref="V-79315" selected="true" /><select idref="V-79317" selected="true" /><select idref="V-79319" selected="true" /><select idref="V-79321" selected="true" /><select idref="V-79323" selected="true" /><select idref="V-79325" selected="true" /><select idref="V-79327" selected="true" /><select idref="V-79329" selected="true" /><select idref="V-79333" selected="true" /><select idref="V-79335" selected="true" /><select idref="V-79337" selected="true" /><select idref="V-79341" selected="true" /><select idref="V-79343" selected="true" /><select idref="V-79345" selected="true" /><select idref="V-79347" selected="true" /><select idref="V-79349" selected="true" /><select idref="V-79351" selected="true" /><select idref="V-79353" selected="true" /><select idref="V-79355" selected="true" /><select idref="V-79357" selected="true" /><select idref="V-97521" selected="true" /></Profile><Group id="V-79119"><title>SRG-APP-000001-DB-000031</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93825r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-003600</version><title>SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.</title><description>&lt;VulnDiscussion&gt;Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks.
 
 This requirement addresses concurrent session control for a single account. It does not address concurrent sessions by a single user via multiple system accounts; and it does not deal with the total number of sessions across all accounts.
 
@@ -237,7 +237,7 @@ Review contents of audit logs, traces and data tables to confirm that the identi
 
 If shared identifiers are found, and not accompanied by individual identifiers, this is a finding.
 
-Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.</check-content></check></Rule></Group><Group id="V-79129"><title>SRG-APP-000080-DB-000063</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93835r3_rule" severity="high" weight="10.0"><version>SQL6-D0-004100</version><title>SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.</title><description>&lt;VulnDiscussion&gt;Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
+Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.</check-content></check></Rule></Group><Group id="V-79129"><title>SRG-APP-000080-DB-000063</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93835r4_rule" severity="high" weight="10.0"><version>SQL6-D0-004100</version><title>SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.</title><description>&lt;VulnDiscussion&gt;Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
 
 Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database.
 
@@ -255,25 +255,27 @@ GO
 
 
 To grant permissions to services or applications, utilize the Service SID of the service or a domain service account.
-</fixtext><fix id="F-85881r2_fix" /><check system="C-78721r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Execute the following queries. The first query lists permissions granted to NT AUTHORITY\SYSTEM. The second query checks for Clustering and Availability Groups being provisioned in the Database Engine:
+</fixtext><fix id="F-85881r2_fix" /><check system="C-78721r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Execute the following queries. The first query checks for Clustering and Availability Groups being provisioned in the Database Engine. The second query lists permissions granted to the Local System account.
+
+SELECT
+    SERVERPROPERTY('IsClustered') AS [IsClustered],
+    SERVERPROPERTY('IsHadrEnabled') AS [IsHadrEnabled]
 
 EXECUTE AS LOGIN = 'NT AUTHORITY\SYSTEM'
 
-SELECT * FROM fn_my_permissions(NULL,NULL)
+SELECT * FROM fn_my_permissions(NULL, 'server')
 
 REVERT
 
 GO
 
-SELECT SERVERPROPERTY('IsClustered') as IsClustered, SERVERPROPERTY('IsHadrEnabled') as IsHadrEnabled
-
-If IsHadrEnabled returns 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "ALTER ANY AVAILABILITY GROUP", and "VIEW ANY DATABASE", this is a finding.
 
-If IsClustered returns 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "VIEW SERVER STATE ", and "VIEW ANY DATABASE", this is a finding.
+If IsClustered returns 1, IsHadrEnabled returns 0, and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding.
 
-If IsHadrEnabled and IsClustered both return 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE ", and "VIEW ANY DATABASE", this is a finding.
+If IsHadrEnabled returns 1 and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding.
 
-If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to SYSTEM beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.</check-content></check></Rule></Group><Group id="V-79131"><title>SRG-APP-000080-DB-000063</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93837r3_rule" severity="medium" weight="10.0"><version>SQL6-D0-004200</version><title>SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.</title><description>&lt;VulnDiscussion&gt;Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
+If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.
+</check-content></check></Rule></Group><Group id="V-79131"><title>SRG-APP-000080-DB-000063</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93837r3_rule" severity="medium" weight="10.0"><version>SQL6-D0-004200</version><title>SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.</title><description>&lt;VulnDiscussion&gt;Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
 
 Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database.
 
@@ -695,7 +697,7 @@ SELECT * FROM sys.server_audits;
 
 By observing the [name] and [is_state_enabled] columns, identify the row or rows in use.
 
-If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.</check-content></check></Rule></Group><Group id="V-79149"><title>SRG-APP-000109-DB-000321</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93855r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-005700</version><title>SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.</title><description>&lt;VulnDiscussion&gt;It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
+If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.</check-content></check></Rule></Group><Group id="V-79149"><title>SRG-APP-000109-DB-000321</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93855r3_rule" severity="medium" weight="10.0"><version>SQL6-D0-005700</version><title>SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.</title><description>&lt;VulnDiscussion&gt;It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.
 
 When availability is an overriding concern, approved actions in response to an audit failure are as follows:
 
@@ -712,7 +714,7 @@ GO
 ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue);
 GO
 ALTER SERVER AUDIT [AuditName] WITH (STATE = ON);
-GO</fixtext><fix id="F-85901r1_fix" /><check system="C-78741r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA).
+GO</fixtext><fix id="F-85901r1_fix" /><check system="C-78741r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA).
 
 Execute the following query:
 
@@ -725,7 +727,7 @@ WHERE a.is_state_enabled = 1
 
 If no records are returned, this is a finding.
 
-If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG,” this is not a finding.
+If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG," this is not a finding.
 
 If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding.
 </check-content></check></Rule></Group><Group id="V-79151"><title>SRG-APP-000118-DB-000059</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93857r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-005900</version><title>The audit information produced by SQL Server must be protected from unauthorized read access.</title><description>&lt;VulnDiscussion&gt;If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage.
@@ -1123,7 +1125,7 @@ EXEC SP_CONFIGURE 'xp_cmdshell';
 
 If the value of "config_value" is "0", this is not a finding.
 
-Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.</check-content></check></Rule></Group><Group id="V-79179"><title>SRG-APP-000141-DB-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93885r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-007300</version><title>Access to CLR code must be disabled or restricted, unless specifically required and approved.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
+Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.</check-content></check></Rule></Group><Group id="V-79179"><title>SRG-APP-000141-DB-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93885r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-007300</version><title>Access to CLR code must be disabled or restricted, unless specifically required and approved.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives.
 
@@ -1144,7 +1146,7 @@ GO
 RECONFIGURE;
 GO
 
-For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.</fixtext><fix id="F-85931r1_fix" /><check system="C-78771r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#.  CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code.  Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.
+For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.</fixtext><fix id="F-85931r1_fix" /><check system="C-78771r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.
 
 To determine if CLR is enabled, execute the following commands:
 
@@ -1154,14 +1156,17 @@ EXEC SP_CONFIGURE 'clr enabled';
 
 If the value of "config_value" is "0", this is not a finding.
 
-Review the system documentation to determine whether the use of CLR code is required and approved. If it is not approved, this is a finding.
+If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding.
 
-If CLR code is required and approved, check for UNSAFE Assembly permission using the following script in Master.  If records are returned and UNSAFE Assembly is not documented and authorized, this is a finding.
+If CLR code is approved, check the database for UNSAFE assembly permission using the following script:
 
+USE [master]
 SELECT *
 FROM sys.assemblies
 WHERE permission_set_desc != 'SAFE'
-AND is_user_defined = 1</check-content></check></Rule></Group><Group id="V-79181"><title>SRG-APP-000141-DB-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93887r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-007400</version><title>Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
+AND is_user_defined = 1;
+
+If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.</check-content></check></Rule></Group><Group id="V-79181"><title>SRG-APP-000141-DB-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93887r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-007400</version><title>Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives.
 
@@ -1252,17 +1257,18 @@ If accounts are determined to be shared, determine if individuals are first indi
 
 If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.
 
-If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.</check-content></check></Rule></Group><Group id="V-79191"><title>SRG-APP-000164-DB-000401</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93897r3_rule" severity="medium" weight="10.0"><version>SQL6-D0-007900</version><title>If DBMS authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity and lifetime.</title><description>&lt;VulnDiscussion&gt;OS/enterprise authentication and identification must be used (SQL2-00-023600).  Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved.
+If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.</check-content></check></Rule></Group><Group id="V-79191"><title>SRG-APP-000164-DB-000401</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93897r4_rule" severity="medium" weight="10.0"><version>SQL6-D0-007900</version><title>If DBMS authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity and lifetime.</title><description>&lt;VulnDiscussion&gt;OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001).  Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved.
 
 The DoD standard for authentication is DoD-approved PKI certificates.  Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval.
 
-In such cases, the DoD standards for password complexity and lifetime must be implemented.  DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so.  For other DBMSs, the rules must be enforced using available configuration parameters or custom code.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000192</ident><fixtext fixref="F-85943r1_fix">Configure the SQL Server operating system and SQL Server logins for compliance.
+In such cases, the DoD standards for password complexity and lifetime must be implemented.  DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so.  For other DBMSs, the rules must be enforced using available configuration parameters or custom code.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000192</ident><fixtext fixref="F-85943r2_fix">Configure the SQL Server operating system and SQL Server logins for compliance.
 
-1. Ensure the DISA Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide password complexity guidelines are met.
+1. Ensure the password complexity requirements for the corresponding DISA Windows Server Security Technical Implementation Guide are met on the server where the SQL Server Instance is installed.
 
 2. Ensure SQL Server is configured to inherit password complexity rules from the operating system for SQL logins. Ensure check of policy and expiration are enforced when SQL logins are created.
 
-CREATE LOGIN [] WITH PASSWORD=N'', CHECK_EXPIRATION=ON, CHECK_POLICY=ON</fixtext><fix id="F-85943r1_fix" /><check system="C-78783r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Check for use of SQL Server Authentication:
+CREATE LOGIN &lt;login_name&gt; WITH PASSWORD= &lt;enterStrongPasswordHere&gt;, CHECK_EXPIRATION = ON, CHECK_POLICY = ON;
+</fixtext><fix id="F-85943r2_fix" /><check system="C-78783r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Check for use of SQL Server Authentication:
 
 SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode]
 
@@ -1467,7 +1473,7 @@ If the procedures or evidence does not exist, this is a finding.
 
 If the procedures do not indicate offline and off-site storage of the Master Key, this is a finding.
 
-If procedures do not indicate access restrictions to the Master Key backup, this is a finding.</check-content></check></Rule></Group><Group id="V-79211"><title>SRG-APP-000243-DB-000373</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93917r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-009800</version><title>SQL Server must prevent unauthorized and unintended information transfer via shared system resources.</title><description>&lt;VulnDiscussion&gt;The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001090</ident><fixtext fixref="F-85963r1_fix">Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process.
+If procedures do not indicate access restrictions to the Master Key backup, this is a finding.</check-content></check></Rule></Group><Group id="V-79211"><title>SRG-APP-000243-DB-000373</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93917r3_rule" severity="medium" weight="10.0"><version>SQL6-D0-009800</version><title>SQL Server must prevent unauthorized and unintended information transfer via shared system resources.</title><description>&lt;VulnDiscussion&gt;The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001090</ident><fixtext fixref="F-85963r1_fix">Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process.
 
 sp_configure 'show advanced options', 1;
 GO
@@ -1476,7 +1482,7 @@ GO
 sp_configure 'common criteria compliance enabled', 1;
 GO
 RECONFIGURE
-GO</fixtext><fix id="F-85963r1_fix" /><check system="C-78803r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance.
+GO</fixtext><fix id="F-85963r1_fix" /><check system="C-78803r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance.
 
 SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs.
 
@@ -1484,13 +1490,14 @@ Review the Instance configuration:
 
 
 SELECT value_in_use
-FROM   sys.configurations
+FROM sys.configurations
 WHERE name = 'common criteria compliance enabled'
 
-If the value returned for "value_in_use" is not "1", and an exception is not defined in the system documentation, this is a finding.
-
+If "value_in_use" is set to "1" this is not a finding.
+If "value_in_use" is set to "0" this is a finding.
 
-NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If enabling this feature impacts performance, this setting may be disabled and the category reduced to a CAT III finding.</check-content></check></Rule></Group><Group id="V-79213"><title>SRG-APP-000243-DB-000373</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93919r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-009900</version><title>SQL Server must prevent unauthorized and unintended information transfer via shared system resources.</title><description>&lt;VulnDiscussion&gt;The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001090</ident><fixtext fixref="F-85965r1_fix">If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.</fixtext><fix id="F-85965r1_fix" /><check system="C-78805r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Review the system documentation to determine if Instant File Initialization (IFI) is required.
+NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding.
+</check-content></check></Rule></Group><Group id="V-79213"><title>SRG-APP-000243-DB-000373</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93919r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-009900</version><title>SQL Server must prevent unauthorized and unintended information transfer via shared system resources.</title><description>&lt;VulnDiscussion&gt;The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001090</ident><fixtext fixref="F-85965r1_fix">If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.</fixtext><fix id="F-85965r1_fix" /><check system="C-78805r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Review the system documentation to determine if Instant File Initialization (IFI) is required.
 
 If IFI is documented as required, this is not a finding.
 
@@ -1513,13 +1520,13 @@ For each of the directories returned by the above script, verify whether the cor
 4) Navigate to the "Security" tab.
 5) Review the listing of principals and permissions.
 
-Account Type                     Directory Type            Permission
+Account Type            Directory Type        Permission
 -----------------------------------------------------------------------------------------------
-Database Administrators          ALL                       Full Control
+Database Administrators          ALL                           Full Control
 SQL Server Service SID           Data; Log; Backup;        Full Control
 SQL Server Agent Service SID     Backup                    Full Control
-SYSTEM                           ALL                       Full Control
-CREATOR OWNER                    ALL                       Full Control
+SYSTEM                               ALL                           Full Control
+CREATOR OWNER                    ALL                           Full Control
 
 For information on how to determine a "Service SID", go to:
 https://aka.ms/sql-service-sids
@@ -1702,13 +1709,15 @@ The appropriate support staff include, at a minimum, the ISSO and the DBA/SA.
 
 Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001855</ident><fixtext fixref="F-85981r1_fix">Utilize operating system alerting mechanisms, SQL Agent, Operations Management tools, and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.</fixtext><fix id="F-85981r1_fix" /><check system="C-78821r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration.
 
-If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.</check-content></check></Rule></Group><Group id="V-79231"><title>SRG-APP-000360-DB-000320</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93937r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-011100</version><title>SQL Server must provide an immediate real-time alert to appropriate support staff of all audit failure events requiring real-time alerts.</title><description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.
+If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.</check-content></check></Rule></Group><Group id="V-79231"><title>SRG-APP-000360-DB-000320</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93937r2_rule" severity="medium" weight="10.0"><version>SQL6-D0-011100</version><title>SQL Server must provide an immediate real-time alert to appropriate support staff of all audit log failures.</title><description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.
 
 The appropriate support staff include, at a minimum, the ISSO and the DBA/SA.
 
-Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001858</ident><fixtext fixref="F-85983r1_fix">Configure the system to provide immediate real-time alerts to appropriate support staff when a specified audit event failures occurs.</fixtext><fix id="F-85983r1_fix" /><check system="C-78823r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Review the system documentation to determine which audit failure events require real-time alerts.
+A failure of database auditing will result in either the database continuing to function without auditing or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions
 
-Review SQL Server settings and code. If the real-time alerting that is specified in the documentation is not enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-79233"><title>SRG-APP-000374-DB-000322</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93939r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-011200</version><title>SQL Server must record time stamps in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).</title><description>&lt;VulnDiscussion&gt;If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis.
+Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001858</ident><fixtext fixref="F-85983r2_fix">Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.</fixtext><fix id="F-85983r2_fix" /><check system="C-78823r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason.
+
+If real-time alerts are not sent upon auditing failure, this is a finding.</check-content></check></Rule></Group><Group id="V-79233"><title>SRG-APP-000374-DB-000322</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93939r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-011200</version><title>SQL Server must record time stamps in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).</title><description>&lt;VulnDiscussion&gt;If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis.
 
 Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001890</ident><fixtext fixref="F-85985r1_fix">Where possible, configure the operating system to automatic synchronize with an official time server, using NTP.
 
@@ -2882,7 +2891,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s
 WHERE a.is_state_enabled = 1
 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP')
 
-If the identified groups are not returned, this is a finding.</check-content></check></Rule></Group><Group id="V-79293"><title>SRG-APP-000504-DB-000355</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93999r3_rule" severity="medium" weight="10.0"><version>SQL6-D0-015000</version><title>SQL Server must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.</title><description>&lt;VulnDiscussion&gt;Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
+If the identified groups are not returned, this is a finding.</check-content></check></Rule></Group><Group id="V-79293"><title>SRG-APP-000504-DB-000355</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-93999r4_rule" severity="medium" weight="10.0"><version>SQL6-D0-015000</version><title>SQL Server must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.</title><description>&lt;VulnDiscussion&gt;Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
 
 System documentation should include a definition of the functionality considered privileged.
 
@@ -2896,7 +2905,7 @@ DENY
 
 Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.
 
-To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-86045r1_fix">Add the required events to the server audit specification
+To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-86045r2_fix">Add the required events to the server audit specification
 USE [master];
 GO
 
@@ -2918,6 +2927,7 @@ ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_P
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP);
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP);
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP);
+ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP);
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP);
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP);
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP);
@@ -2935,7 +2945,8 @@ ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANG
 GO
 
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON);
-GO</fixtext><fix id="F-86045r1_fix" /><check system="C-78885r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Determine if an audit is configured and started by executing the following query.
+GO
+</fixtext><fix id="F-86045r2_fix" /><check system="C-78885r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Determine if an audit is configured and started by executing the following query.
 
 SELECT name AS 'Audit Name',
 status_desc AS 'Audit Status',
@@ -2985,10 +2996,43 @@ FROM sys.server_audit_specifications s
 JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
 JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
 WHERE a.is_state_enabled = 1
-AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP',’ LOGOUT_GROUP’,'SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP')
+AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP',
+'AUDIT_CHANGE_GROUP',
+'BACKUP_RESTORE_GROUP',
+'DATABASE_CHANGE_GROUP',
+'DATABASE_OBJECT_CHANGE_GROUP',
+'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP',
+'DATABASE_OPERATION_GROUP',
+'DATABASE_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_PERMISSION_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_IMPERSONATION_GROUP',
+'DATABASE_ROLE_MEMBER_CHANGE_GROUP',
+'DBCC_GROUP',
+'LOGIN_CHANGE_PASSWORD_GROUP',
+'LOGOUT_GROUP',
+'SCHEMA_OBJECT_CHANGE_GROUP',
+'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OBJECT_CHANGE_GROUP',
+'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SERVER_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OPERATION_GROUP',
+'SERVER_PERMISSION_CHANGE_GROUP',
+'SERVER_PRINCIPAL_CHANGE_GROUP',
+'SERVER_PRINCIPAL_IMPERSONATION_GROUP',
+'SERVER_ROLE_MEMBER_CHANGE_GROUP',
+'SERVER_STATE_CHANGE_GROUP',
+'TRACE_CHANGE_GROUP',
+'USER_CHANGE_PASSWORD_GROUP'
+)
+Order by d.audit_action_name
+
 
 If the identified groups are not returned, this is a finding.
-</check-content></check></Rule></Group><Group id="V-79295"><title>SRG-APP-000505-DB-000352</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-94001r3_rule" severity="medium" weight="10.0"><version>SQL6-D0-015100</version><title>SQL Server must generate audit records showing starting and ending time for user access to the database(s).</title><description>&lt;VulnDiscussion&gt;For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs.
+
+</check-content></check></Rule></Group><Group id="V-79295"><title>SRG-APP-000505-DB-000352</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-94001r4_rule" severity="medium" weight="10.0"><version>SQL6-D0-015100</version><title>SQL Server must generate audit records showing starting and ending time for user access to the database(s).</title><description>&lt;VulnDiscussion&gt;For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs.
 
 Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2016</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2016</dc:subject><dc:identifier>3219</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-86047r1_fix">Add the "LOGOUT_GROUP" to the server audit specification
 USE [master];
@@ -3001,7 +3045,7 @@ ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GRO
 GO
 
 ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON);
-GO</fixtext><fix id="F-86047r1_fix" /><check system="C-78887r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Determine if an audit is configured and started by executing the following query:
+GO</fixtext><fix id="F-86047r1_fix" /><check system="C-78887r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS_SQL_Server_2016_Instance_STIG.xml" /><check-content>Determine if an audit is configured and started by executing the following query:
 
 SELECT name AS 'Audit Name',
 status_desc AS 'Audit Status',
@@ -3051,9 +3095,42 @@ FROM sys.server_audit_specifications s
 JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
 JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
 WHERE a.is_state_enabled = 1
-AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP',’ LOGOUT_GROUP’,'SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP')
+AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP',
+'AUDIT_CHANGE_GROUP',
+'BACKUP_RESTORE_GROUP',
+'DATABASE_CHANGE_GROUP',
+'DATABASE_OBJECT_CHANGE_GROUP',
+'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP',
+'DATABASE_OPERATION_GROUP',
+'DATABASE_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_PERMISSION_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_IMPERSONATION_GROUP',
+'DATABASE_ROLE_MEMBER_CHANGE_GROUP',
+'DBCC_GROUP',
+'LOGIN_CHANGE_PASSWORD_GROUP',
+'LOGOUT_GROUP',
+'SCHEMA_OBJECT_CHANGE_GROUP',
+'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OBJECT_CHANGE_GROUP',
+'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SERVER_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OPERATION_GROUP',
+'SERVER_PERMISSION_CHANGE_GROUP',
+'SERVER_PRINCIPAL_CHANGE_GROUP',
+'SERVER_PRINCIPAL_IMPERSONATION_GROUP',
+'SERVER_ROLE_MEMBER_CHANGE_GROUP',
+'SERVER_STATE_CHANGE_GROUP',
+'TRACE_CHANGE_GROUP',
+'USER_CHANGE_PASSWORD_GROUP'
+)
+Order by d.audit_action_name
+
 
 If the identified groups are not returned, this is a finding.
+
 </check-content></check></Rule></Group><Group id="V-79297"><title>SRG-APP-000506-DB-000353</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-94003r1_rule" severity="medium" weight="10.0"><version>SQL6-D0-015200</version><title>SQL Server must generate audit records when concurrent logons/connections by the same user from different workstations occur.</title><description>&lt;VulnDiscussion&gt;For completeness of forensic analysis, it is necessary to track who logs on to SQL Server.
 
 Concurrent connections by the same user from multiple workstations may be valid use of the system; or such connections may be due to improper circumvention of the requirement to use the CAC for authentication; or they may indicate unauthorized account sharing; or they may be because an account has been compromised.
diff --git a/StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.log b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_Instance_2012_V1R20_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.log
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_Instance_2012_V1R20_Manual-xccdf.log
diff --git a/StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_Instance_2012_V1R20_Manual-xccdf.xml
similarity index 79%
rename from StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.xml
rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_Instance_2012_V1R20_Manual-xccdf.xml
index 6f5229e57..1cf62ec01 100644
--- a/StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.xml	
+++ b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_Instance_2012_V1R20_Manual-xccdf.xml	
@@ -1,16 +1,16 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Microsoft_SQL_Server_2012_Database_Instance_Security_Technical_Implementation_Guide" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2018-02-27">accepted</status><title>Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide</title><description>The Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 17 Benchmark Date: 27 Apr 2018</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40917" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-53877" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40917" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-53877" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40917" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-53877" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Group id="V-40905"><title>SRG-APP-000268-DB-000164</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53259r5_rule" severity="medium" weight="10.0"><version>SQL2-00-023000</version><title>The system must activate an alarm and/or automatically shut SQL Server down if a failure is detected in its software components. </title><description>&lt;VulnDiscussion&gt;Predictable failure prevention requires organizational planning to address system failure issues. If components key to maintaining system security fail to function, then SQL Server could continue operating in an unsecure state. The organization must be prepared, and the system must be configured, to send an alarm for such conditions and/or automatically shut SQL Server down.
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="MS_SQL_Server_Instance_2012" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-02-12">accepted</status><title>Microsoft SQL Server Instance 2012 Security Technical Implementation Guide</title><description>The Microsoft SQL Server 2012 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 20 Benchmark Date: 16 Jan 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40917" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-53877" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40917" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-53877" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40917" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-40905" selected="true" /><select idref="V-40906" selected="true" /><select idref="V-40907" selected="true" /><select idref="V-40908" selected="true" /><select idref="V-40909" selected="true" /><select idref="V-40910" selected="true" /><select idref="V-40912" selected="true" /><select idref="V-40913" selected="true" /><select idref="V-40914" selected="true" /><select idref="V-40915" selected="true" /><select idref="V-40916" selected="true" /><select idref="V-40918" selected="true" /><select idref="V-40919" selected="true" /><select idref="V-40922" selected="true" /><select idref="V-40923" selected="true" /><select idref="V-40924" selected="true" /><select idref="V-40925" selected="true" /><select idref="V-40926" selected="true" /><select idref="V-40927" selected="true" /><select idref="V-40928" selected="true" /><select idref="V-40929" selected="true" /><select idref="V-40930" selected="true" /><select idref="V-40932" selected="true" /><select idref="V-40933" selected="true" /><select idref="V-40934" selected="true" /><select idref="V-40935" selected="true" /><select idref="V-40936" selected="true" /><select idref="V-40937" selected="true" /><select idref="V-40938" selected="true" /><select idref="V-40939" selected="true" /><select idref="V-40940" selected="true" /><select idref="V-40941" selected="true" /><select idref="V-40942" selected="true" /><select idref="V-40943" selected="true" /><select idref="V-40944" selected="true" /><select idref="V-40945" selected="true" /><select idref="V-40946" selected="true" /><select idref="V-40947" selected="true" /><select idref="V-40948" selected="true" /><select idref="V-40949" selected="true" /><select idref="V-40950" selected="true" /><select idref="V-40951" selected="true" /><select idref="V-40952" selected="true" /><select idref="V-40953" selected="true" /><select idref="V-41016" selected="true" /><select idref="V-41017" selected="true" /><select idref="V-41021" selected="true" /><select idref="V-41022" selected="true" /><select idref="V-41023" selected="true" /><select idref="V-41024" selected="true" /><select idref="V-41025" selected="true" /><select idref="V-41026" selected="true" /><select idref="V-41027" selected="true" /><select idref="V-41028" selected="true" /><select idref="V-41029" selected="true" /><select idref="V-41030" selected="true" /><select idref="V-41031" selected="true" /><select idref="V-41032" selected="true" /><select idref="V-41033" selected="true" /><select idref="V-41034" selected="true" /><select idref="V-41035" selected="true" /><select idref="V-41036" selected="true" /><select idref="V-41037" selected="true" /><select idref="V-41038" selected="true" /><select idref="V-41039" selected="true" /><select idref="V-41040" selected="true" /><select idref="V-41041" selected="true" /><select idref="V-41042" selected="true" /><select idref="V-41043" selected="true" /><select idref="V-41044" selected="true" /><select idref="V-41045" selected="true" /><select idref="V-41046" selected="true" /><select idref="V-41047" selected="true" /><select idref="V-41202" selected="true" /><select idref="V-41204" selected="true" /><select idref="V-41205" selected="true" /><select idref="V-41206" selected="true" /><select idref="V-41207" selected="true" /><select idref="V-41208" selected="true" /><select idref="V-41209" selected="true" /><select idref="V-41246" selected="true" /><select idref="V-41247" selected="true" /><select idref="V-41248" selected="true" /><select idref="V-41250" selected="true" /><select idref="V-41251" selected="true" /><select idref="V-41252" selected="true" /><select idref="V-41253" selected="true" /><select idref="V-41254" selected="true" /><select idref="V-41255" selected="true" /><select idref="V-41256" selected="true" /><select idref="V-41257" selected="true" /><select idref="V-41258" selected="true" /><select idref="V-41259" selected="true" /><select idref="V-41260" selected="true" /><select idref="V-41261" selected="true" /><select idref="V-41262" selected="true" /><select idref="V-41263" selected="true" /><select idref="V-41264" selected="true" /><select idref="V-41265" selected="true" /><select idref="V-41266" selected="true" /><select idref="V-41267" selected="true" /><select idref="V-41268" selected="true" /><select idref="V-41269" selected="true" /><select idref="V-41270" selected="true" /><select idref="V-41271" selected="true" /><select idref="V-41273" selected="true" /><select idref="V-41274" selected="true" /><select idref="V-41275" selected="true" /><select idref="V-41276" selected="true" /><select idref="V-41277" selected="true" /><select idref="V-41278" selected="true" /><select idref="V-41279" selected="true" /><select idref="V-41280" selected="true" /><select idref="V-41281" selected="true" /><select idref="V-41283" selected="true" /><select idref="V-41284" selected="true" /><select idref="V-41285" selected="true" /><select idref="V-41286" selected="true" /><select idref="V-41287" selected="true" /><select idref="V-41288" selected="true" /><select idref="V-41289" selected="true" /><select idref="V-41290" selected="true" /><select idref="V-41291" selected="true" /><select idref="V-41292" selected="true" /><select idref="V-41293" selected="true" /><select idref="V-41294" selected="true" /><select idref="V-41295" selected="true" /><select idref="V-41296" selected="true" /><select idref="V-41297" selected="true" /><select idref="V-41298" selected="true" /><select idref="V-41299" selected="true" /><select idref="V-41300" selected="true" /><select idref="V-41302" selected="true" /><select idref="V-41303" selected="true" /><select idref="V-41304" selected="true" /><select idref="V-41305" selected="true" /><select idref="V-41306" selected="true" /><select idref="V-41307" selected="true" /><select idref="V-41311" selected="true" /><select idref="V-41419" selected="true" /><select idref="V-43196" selected="true" /><select idref="V-53877" selected="true" /><select idref="V-54859" selected="true" /><select idref="V-54879" selected="true" /><select idref="V-54881" selected="true" /><select idref="V-55805" selected="true" /><select idref="V-59857" selected="true" /><select idref="V-59915" selected="true" /><select idref="V-69169" selected="true" /><select idref="V-70625" selected="true" /><select idref="V-72413" selected="true" /><select idref="V-72415" selected="true" /></Profile><Group id="V-40905"><title>SRG-APP-000268-DB-000164</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53259r5_rule" severity="medium" weight="10.0"><version>SQL2-00-023000</version><title>The system must activate an alarm and/or automatically shut SQL Server down if a failure is detected in its software components. </title><description>&lt;VulnDiscussion&gt;Predictable failure prevention requires organizational planning to address system failure issues. If components key to maintaining system security fail to function, then SQL Server could continue operating in an unsecure state. The organization must be prepared, and the system must be configured, to send an alarm for such conditions and/or automatically shut SQL Server down.
 
 If appropriate actions are not taken when component failures occur, a denial of service condition may occur. Appropriate actions can include conducting a graceful application shutdown to avoid losing information.
 
-For the purposes of this requirement, "component" may be interpreted as meaning any of the Windows services that comprise a SQL Server instance.  "The system" encompasses SQL Server itself, the Windows operating system, and any monitoring/management tools used to control the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001328</ident><fixtext fixref="F-46187r4_fix">Configure the system to activate an alarm and/or trigger a SQL Server shutdown when a component failure is detected.</fixtext><fix id="F-46187r4_fix" /><check system="C-47560r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check the configuration of SQL Server, the operating system and any monitoring/management tools to verify the system activates an alarm and/or triggers a shutdown of SQL Server when a component failure is detected.
+For the purposes of this requirement, "component" may be interpreted as meaning any of the Windows services that comprise a SQL Server instance.  "The system" encompasses SQL Server itself, the Windows operating system, and any monitoring/management tools used to control the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001328</ident><fixtext fixref="F-46187r4_fix">Configure the system to activate an alarm and/or trigger a SQL Server shutdown when a component failure is detected.</fixtext><fix id="F-46187r4_fix" /><check system="C-47560r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check the configuration of SQL Server, the operating system and any monitoring/management tools to verify the system activates an alarm and/or triggers a shutdown of SQL Server when a component failure is detected.
 
 If system does not take either or both actions, this is a finding.</check-content></check></Rule></Group><Group id="V-40906"><title>SRG-APP-000265-DB-000161</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53260r2_rule" severity="medium" weight="10.0"><version>SQL2-00-022700</version><title>SQL Server must identify potential security-relevant error conditions.</title><description>&lt;VulnDiscussion&gt;The structure and content of SQL Server error messages need to be carefully considered by the organization and development team. The extent to which the application is able to identify and handle error conditions is guided by organizational policy and operational requirements.
 
 Database logs can be monitored for specific security-related errors. Any error that can have a negative effect on database security should be quickly identified and forwarded to the appropriate personnel. If security-relevant error conditions are not identified by SQL Server they may be overlooked by the personnel responsible for addressing them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46188r2_fix">Monitor SQL Server log files to determine when a security-related error occurs.
 
-Add/Update list of appropriate personnel that are to be alerted when a security related error condition occurs to system documentation. Consider an automated job for both the monitor and the alerting.</fixtext><fix id="F-46188r2_fix" /><check system="C-47561r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Security-related errors must be identified and monitored. In most cases, these items would appear in the SQL Server log file.  
+Add/Update list of appropriate personnel that are to be alerted when a security related error condition occurs to system documentation. Consider an automated job for both the monitor and the alerting.</fixtext><fix id="F-46188r2_fix" /><check system="C-47561r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Security-related errors must be identified and monitored. In most cases, these items would appear in the SQL Server log file.
 
-If security-related error conditions are not being monitored to meet this requirement, this is a finding.</check-content></check></Rule></Group><Group id="V-40907"><title>SRG-APP-000264-DB-000136</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53261r4_rule" severity="high" weight="10.0"><version>SQL2-00-022600</version><title>SQL Server must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission.</title><description>&lt;VulnDiscussion&gt;Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel. 
+If security-related error conditions are not being monitored to meet this requirement, this is a finding.</check-content></check></Rule></Group><Group id="V-40907"><title>SRG-APP-000264-DB-000136</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53261r4_rule" severity="high" weight="10.0"><version>SQL2-00-022600</version><title>SQL Server must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission.</title><description>&lt;VulnDiscussion&gt;Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel.
 
 Information in transmission is particularly vulnerable to attack. If the DBMS does not employ cryptographic mechanisms preventing unauthorized disclosure of information during transit, the information may be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002421</ident><fixtext fixref="F-46189r4_fix">Deploy organization-approved encryption to the SQL Server network connections.
 
@@ -21,7 +21,7 @@ Where physical network devices are used for encryption, set them up such that:
 3. The encryption keys utilized are current and valid keys.
 4. The keys utilized meet approved organizationally defined compliant algorithms.
 
-Where SQL Server network encryption is used, open SQL Server Configuration Manager.  Navigate to SQL Server Configuration Manager &gt;&gt; SQL Server Network Configuration. Right click on Protocols for [NAME OF INSTANCE], where [NAME OF INSTANCE] is a placeholder for the SQL Server instance name, and click on Properties.  On the Flags tab, set Force Encryption to YES, provide a DoD certificate on the Certificate tab.   </fixtext><fix id="F-46189r4_fix" /><check system="C-47562r9_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If the DBMS exists in the unclassified environment, and data transmission does not cross the boundary between the NIPRNet and the wider Internet, and the application owner and authorizing official have determined that encryption is not required, this is not a finding.
+Where SQL Server network encryption is used, open SQL Server Configuration Manager.  Navigate to SQL Server Configuration Manager &gt;&gt; SQL Server Network Configuration. Right click on Protocols for [NAME OF INSTANCE], where [NAME OF INSTANCE] is a placeholder for the SQL Server instance name, and click on Properties.  On the Flags tab, set Force Encryption to YES, provide a DoD certificate on the Certificate tab.   </fixtext><fix id="F-46189r4_fix" /><check system="C-47562r9_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If the DBMS exists in the unclassified environment, and data transmission does not cross the boundary between the NIPRNet and the wider Internet, and the application owner and authorizing official have determined that encryption is not required, this is not a finding.
 
 Check SQL Server and network settings to determine whether cryptographic mechanisms are used to prevent the unauthorized disclosure of information during transmission. If not, this is a finding.
 
@@ -46,11 +46,11 @@ If Force Encryption is set to "NO" or a DoD Certificate is not utilized, and phy
 
 If the primary SQL Server has a backup/secondary server that is dedicated 100% to the primary server's process, this is not a finding. If, however, the processing of the primary SQL Server is loaded to a secondary server that is already partly resourced to process something other than that of the primary SQL Server responsibility, then there can be load balancing issues.
 
-Load balancing for the purpose of sharing a secondary/backup SQL Server is often done to share and save on resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002394</ident><fixtext fixref="F-46190r3_fix">Allocate replacement server(s) to provide failover support to the Primary SQL Server. 
+Load balancing for the purpose of sharing a secondary/backup SQL Server is often done to share and save on resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002394</ident><fixtext fixref="F-46190r3_fix">Allocate replacement server(s) to provide failover support to the Primary SQL Server.
 
-If a single solution cannot be employed, split the processing of a secondary SQL Server amongst two or more secondary servers.</fixtext><fix id="F-46190r3_fix" /><check system="C-47563r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If Database Availability Groups are not being used, this is not applicable (NA).
+If a single solution cannot be employed, split the processing of a secondary SQL Server amongst two or more secondary servers.</fixtext><fix id="F-46190r3_fix" /><check system="C-47563r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If Database Availability Groups are not being used, this is not applicable (NA).
 
-Check the system documentation and check with the administrator regarding processing resources of the backup/secondary SQL Server. 
+Check the system documentation and check with the administrator regarding processing resources of the backup/secondary SQL Server.
 
 If the primary SQL Server has a backup/secondary server that is dedicated 100% to the primary server's processing, this is not a finding.
 
@@ -62,33 +62,33 @@ SQL Server often runs queries for multiple users at the same time. If lower prio
 
 Even if SQL Server's utilization is very small and there may seem to be no need to priority protection, often resources grow exponentially and must be implemented as part of an initial deployment.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002394</ident><fixtext fixref="F-46191r2_fix">SQL Server utilizes the "Resource Governor" to determine who is allowed high processing resources. There are several configurations regarding the "Resource Governor" that mostly comes down to users or groups of users having a "MAX_CPU_PERCENT", "MIN_CPU_PERCENT", "MIN_MEMORY_PERCENT", and/or "MAX_MEMORY_PERCENT" settings.
 
-Users are assigned to Workgroups and the Workgroups are configured processing resources via the "Resource Governor".</fixtext><fix id="F-46191r2_fix" /><check system="C-47564r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review system documentation and determine if one type or more of SQL Server users has a business need for priority usage over other types of users. The need for prioritization most frequently occurs when SQL Server resources are shared between two or more applications or systems where the number of users on more than one system is small or non-existent. This needs to be the case, because SQL Server limits resource based on user accounts and not what process is running.
+Users are assigned to Workgroups and the Workgroups are configured processing resources via the "Resource Governor".</fixtext><fix id="F-46191r2_fix" /><check system="C-47564r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review system documentation and determine if one type or more of SQL Server users has a business need for priority usage over other types of users. The need for prioritization most frequently occurs when SQL Server resources are shared between two or more applications or systems where the number of users on more than one system is small or non-existent. This needs to be the case, because SQL Server limits resource based on user accounts and not what process is running.
 
 If SQL Server has users that are determined to run significantly high priority processes than other users and the SQL Server "Resource Governor" is not being implemented, this is a finding.</check-content></check></Rule></Group><Group id="V-40910"><title>SRG-APP-000233-DB-000124</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53264r3_rule" severity="medium" weight="10.0"><version>SQL2-00-021500</version><title>SQL Server must isolate security functions from nonsecurity functions by means of separate security domains.</title><description>&lt;VulnDiscussion&gt;Security functions are defined as "the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based".
 
 Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles.
 
-Database Management Systems typically separate security functionality from nonsecurity functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and nonsecurity functionality is commingled, users who have access to nonsecurity functionality may be able to access security functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001084</ident><fixtext fixref="F-46192r1_fix">Locate security-related database objects and code in a separate database, schema, or other separate security domain from database objects and code implementing application logic.</fixtext><fix id="F-46192r1_fix" /><check system="C-47565r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Determine elements of security functionality (lists of permissions, additional authentication information, stored procedures, application specific auditing, etc.) which are being housed inside SQL server.
+Database Management Systems typically separate security functionality from nonsecurity functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and nonsecurity functionality is commingled, users who have access to nonsecurity functionality may be able to access security functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001084</ident><fixtext fixref="F-46192r1_fix">Locate security-related database objects and code in a separate database, schema, or other separate security domain from database objects and code implementing application logic.</fixtext><fix id="F-46192r1_fix" /><check system="C-47565r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Determine elements of security functionality (lists of permissions, additional authentication information, stored procedures, application specific auditing, etc.) which are being housed inside SQL server.
 
 For any elements found, check SQL Server to determine if these objects or code implementing security functionality are located in a separate security domain, such as a separate database or schema created specifically for security functionality.
 
 Run the following queryto list all the user-defined databases:
-SELECT Name 
-FROM sys.databases 
-WHERE database_id &gt; 4 
+SELECT Name
+FROM sys.databases
+WHERE database_id &gt; 4
 ORDER BY 1;
 
-If security-related database objects or code are not kept separate, this is a finding.</check-content></check></Rule></Group><Group id="V-40912"><title>SRG-APP-000203-DB-000146</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53266r3_rule" severity="low" weight="10.0"><version>SQL2-00-020400</version><title>SQL Server must associate and maintain security labels when exchanging information between systems.</title><description>&lt;VulnDiscussion&gt;When data is exchanged between information systems, the security attributes associated with said data need to be maintained.  
+If security-related database objects or code are not kept separate, this is a finding.</check-content></check></Rule></Group><Group id="V-40912"><title>SRG-APP-000203-DB-000146</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53266r3_rule" severity="low" weight="10.0"><version>SQL2-00-020400</version><title>SQL Server must associate and maintain security labels when exchanging information between systems.</title><description>&lt;VulnDiscussion&gt;When data is exchanged between information systems, the security attributes associated with said data need to be maintained.
 
-Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. 
+Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy.
 
-Security attributes may be explicitly or implicitly associated with the information contained within the information system. 
+Security attributes may be explicitly or implicitly associated with the information contained within the information system.
 
-If database security labels are not maintained as information moves between systems, handling instructions can be lost and data can be accidentally distributed to unauthorized individuals.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001157</ident><fixtext fixref="F-46194r3_fix">Develop SQL code or acquire a third party tool to perform data labeling. SQL Server Label Security Toolkit can be downloaded from http://www.codeplex.com. This tool can satisfy all data labeling and security data labeling requirements.</fixtext><fix id="F-46194r3_fix" /><check system="C-47567r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
+If database security labels are not maintained as information moves between systems, handling instructions can be lost and data can be accidentally distributed to unauthorized individuals.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001157</ident><fixtext fixref="F-46194r3_fix">Develop SQL code or acquire a third party tool to perform data labeling. SQL Server Label Security Toolkit can be downloaded from http://www.codeplex.com. This tool can satisfy all data labeling and security data labeling requirements.</fixtext><fix id="F-46194r3_fix" /><check system="C-47567r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL developed means or via a third-party tool. Check to ensure that labels are being associated to data when information is being exchanged between systems.   
+Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL developed means or via a third-party tool. Check to ensure that labels are being associated to data when information is being exchanged between systems.
 
 If the labeling is not being associated to data when exchanging data between systems, this is a finding.</check-content></check></Rule></Group><Group id="V-40913"><title>SRG-APP-000201-DB-000145</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53267r3_rule" severity="medium" weight="10.0"><version>SQL2-00-020300</version><title>SQL Server must protect the integrity of publicly available information and SQL Servers configuration from unauthorized Server Roles access.</title><description>&lt;VulnDiscussion&gt;The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it.
 
@@ -96,7 +96,7 @@ The user account associated with public access must not have access to the OS or
 
 This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46195r2_fix">Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'user account'&gt; &gt;&gt; Properties &gt;&gt; Server Roles.
 
-Uncheck the 'Server Roles' that are checked and grant more than read-only access to the publicly available information.</fixtext><fix id="F-46195r2_fix" /><check system="C-47568r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
+Uncheck the 'Server Roles' that are checked and grant more than read-only access to the publicly available information.</fixtext><fix id="F-46195r2_fix" /><check system="C-47568r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 Obtain from the DBA or system documentation the list of publicly available data within SQL Server and the role names that assign read-only access to that public data.
 
@@ -117,7 +117,7 @@ SQL Server access to any of the three system databases (master, model, or msdb)
 
 This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46196r2_fix">Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'user account'&gt; &gt;&gt; Properties &gt;&gt; User Mapping &gt;&gt; highlight checked database.
 
-Uncheck the 'Database role membership' that is checked and grants more than read-only access to the publicly available information.</fixtext><fix id="F-46196r2_fix" /><check system="C-47569r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
+Uncheck the 'Database role membership' that is checked and grants more than read-only access to the publicly available information.</fixtext><fix id="F-46196r2_fix" /><check system="C-47569r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 Obtain from the DBA or system documentation the list of publicly available data within SQL Server.
 
@@ -145,7 +145,7 @@ Right click &lt;'the group to modify' &gt;&gt; Properties &gt;&gt; 'Members:'
 
 Remove the publicly available user account from the group by clicking/highlighting the account and then clicking the 'Remove' button.
 
-Revoke any update permissions for a guest being used in the context of a guest account.</fixtext><fix id="F-46197r2_fix" /><check system="C-47570r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
+Revoke any update permissions for a guest being used in the context of a guest account.</fixtext><fix id="F-46197r2_fix" /><check system="C-47570r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 If SQL Server supports an application collecting information from the public, this is NA.
 
@@ -171,12 +171,12 @@ Likely the only 'Server roles' assignment for the publicly available user accoun
 
 This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46198r2_fix">Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'user account'&gt; &gt;&gt; Properties &gt;&gt; Securables &gt;&gt; highlight 'Securable Name'.
 
-Uncheck all 'Grant', 'With Grant', and 'Deny' for the highlighted 'Securable'.</fixtext><fix id="F-46198r2_fix" /><check system="C-47571r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
+Uncheck all 'Grant', 'With Grant', and 'Deny' for the highlighted 'Securable'.</fixtext><fix id="F-46198r2_fix" /><check system="C-47571r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 If SQL Server supports an application collecting information from the public, this is NA.
 
 Obtain from the DBA or system documentation the list of publicly available data within SQL Server.
-Obtain the publicly available user account(s) being used to access SQL Server. 
+Obtain the publicly available user account(s) being used to access SQL Server.
 
 Determine if SQL Server is granting more than read access to the publicly available information through SQL Server 'Securables'.
 
@@ -194,7 +194,7 @@ Developed using established NSA business processes and containing NSA approved a
 
 NSA-approved cryptography is required to be used for classified information system processing.
 
-See FIPS Publication 140-2 and related documents for guidance on approved encryption techniques and certified encryption modules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002450</ident><fixtext fixref="F-46199r1_fix">Configure SQL Server to encrypt sensitive or classified data stored in each database. Use only NIST-certified or NSA-approved cryptography to provide encryption.</fixtext><fix id="F-46199r1_fix" /><check system="C-47572r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If the system exists in the non-classified environment, this is NA.
+See FIPS Publication 140-2 and related documents for guidance on approved encryption techniques and certified encryption modules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002450</ident><fixtext fixref="F-46199r1_fix">Configure SQL Server to encrypt sensitive or classified data stored in each database. Use only NIST-certified or NSA-approved cryptography to provide encryption.</fixtext><fix id="F-46199r1_fix" /><check system="C-47572r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If the system exists in the non-classified environment, this is NA.
 
 For each database under the SQL Server instance, review the system documentation to determine whether the database holds classified or sensitive information. If it does not, this is not a finding.
 
@@ -244,7 +244,7 @@ CREATE CERTIFICATE &lt;certificate name&gt;
 Run the following SQL script to create a symmetric key and assign an existing certificate:
 USE &lt;database name&gt;
 CREATE SYMMETRIC KEY &lt;'key name'&gt;
-   WITH ALGORITHM = AES_256 
+   WITH ALGORITHM = AES_256
    ENCRYPTION BY CERTIFICATE &lt;certificate name&gt;
 
 Assign the application object owner account as the owner of asymmetric and symmetric keys, and certificates.  (Ownership is assigned via the AUTHORIZATION clause of the CREATE statement, or the ALTER AUTHORIZATION statement.)
@@ -265,7 +265,7 @@ WITH ALGORITHM = AES_256
 ENCRYPTION BY SERVER CERTIFICATE &lt;certificate name&gt;;
 ALTER DATABASE &lt;database name&gt;
 SET ENCRYPTION ON;
-</fixtext><fix id="F-46200r9_fix" /><check system="C-47573r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review system documentation to determine whether cryptography for classified or sensitive information is required by the information owner.
+</fixtext><fix id="F-46200r9_fix" /><check system="C-47573r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review system documentation to determine whether cryptography for classified or sensitive information is required by the information owner.
 
 If the system documentation does not specify the type of information hosted on SQL Server: classified, sensitive and/or unclassified, this is a finding.
 
@@ -302,17 +302,17 @@ Detailed information on the NIST Cryptographic Module Validation Program (CMVP)
 
 Non-organizational users shall be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server.
 
-This may be accomplished by a code embedded within the userid, or via a flag or code columns in a table of users, or by some other means. In any case, the user must be individually identified to, and within, SQL Server via a mapping to an individual account and not mapping to a shared account. 
+This may be accomplished by a code embedded within the userid, or via a flag or code columns in a table of users, or by some other means. In any case, the user must be individually identified to, and within, SQL Server via a mapping to an individual account and not mapping to a shared account.
 
 Accordingly, a risk assessment is used in determining the authentication needs of the organization.
 
-Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, and other organizations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000804</ident><fixtext fixref="F-46201r2_fix">Configure SQL Server to uniquely identify and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts.</fixtext><fix id="F-46201r2_fix" /><check system="C-47574r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review documentation, SQL Server settings and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system.
+Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, and other organizations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000804</ident><fixtext fixref="F-46201r2_fix">Configure SQL Server to uniquely identify and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts.</fixtext><fix id="F-46201r2_fix" /><check system="C-47574r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review documentation, SQL Server settings and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system.
 
 If non-organizational users are not uniquely identified and authenticated, this is a finding.</check-content></check></Rule></Group><Group id="V-40922"><title>SRG-APP-000171-DB-000074</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53276r2_rule" severity="medium" weight="10.0"><version>SQL2-00-018600</version><title>SQL Server must enforce password encryption for storage.</title><description>&lt;VulnDiscussion&gt;SQL Server must enforce password encryption when storing passwords. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read and easily compromised.
 
 Passwords stored in clear text are vulnerable to unauthorized disclosure. Database passwords should always be encoded or encrypted when stored internally or externally to SQL Server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000196</ident><fixtext fixref="F-46204r2_fix">Develop, document, and maintain a list of SQL Server database objects, database configuration files, associated scripts, and applications defined within or external to SQL Server that access the database/user environment files/settings in the System Security Plan.
 
-Record whether they do or do not contain SQL Server passwords. If passwords are present, ensure they are encrypted.</fixtext><fix id="F-46204r2_fix" /><check system="C-47577r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Since Windows security is being leveraged, this check applies to database configuration files, associated scripts, and applications external to SQL Server that access the database.  
+Record whether they do or do not contain SQL Server passwords. If passwords are present, ensure they are encrypted.</fixtext><fix id="F-46204r2_fix" /><check system="C-47577r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Since Windows security is being leveraged, this check applies to database configuration files, associated scripts, and applications external to SQL Server that access the database.
 
 Ask the DBA and/or IAO to determine if any SQL Server database objects, database configuration files, associated scripts, or applications defined as external to SQL Server that access the database/user environment files/settings contain database passwords. If any do, confirm that SQL Server passwords stored externally to the SQL Server are encoded or encrypted. If any passwords are stored in clear text, this is a finding.</check-content></check></Rule></Group><Group id="V-40923"><title>SRG-APP-000153-DB-000108</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53277r3_rule" severity="medium" weight="10.0"><version>SQL2-00-018500</version><title>SQL Server must ensure users are authenticated with an individual authenticator prior to using a shared authenticator.</title><description>&lt;VulnDiscussion&gt;To ensure individual accountability and prevent unauthorized access, application users (and any processes acting on behalf of users) must be individually identified and authenticated.
 
@@ -324,7 +324,7 @@ Legitimate use of shared accounts includes, for example, connection pooling.  Si
 
 Build/configure applications to ensure successful individual authentication prior to shared account access.
 
-Ensure each user's identity is received and used in audit data in all relevant circumstances.</fixtext><fix id="F-46205r4_fix" /><check system="C-47578r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review SQL Server users to determine whether shared accounts exist.
+Ensure each user's identity is received and used in audit data in all relevant circumstances.</fixtext><fix id="F-46205r4_fix" /><check system="C-47578r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review SQL Server users to determine whether shared accounts exist.
 
 If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.
 
@@ -336,7 +336,7 @@ Users (and any processes acting on behalf of users) are uniquely identified and
 
 Build/configure applications to ensure successful individual authentication prior to shared account access.
 
-Ensure each user's identity is received and used in audit data in all relevant circumstances.</fixtext><fix id="F-46206r2_fix" /><check system="C-47579r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review SQL Server users to determine whether shared accounts exist. (This does not include when SQL Server has a guest or public account that is providing access to publicly available information.)
+Ensure each user's identity is received and used in audit data in all relevant circumstances.</fixtext><fix id="F-46206r2_fix" /><check system="C-47579r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review SQL Server users to determine whether shared accounts exist. (This does not include when SQL Server has a guest or public account that is providing access to publicly available information.)
 
 If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.
 
@@ -348,7 +348,7 @@ Backups shall be consistent with organization-defined recovery time and recovery
 
 SQL Server depends upon the availability and integrity of its software libraries. Without backups, compromise or loss of the software libraries can prevent a successful recovery of SQL Server operations.
 
-A mixture of full and incremental server-level backups by a third-party tool that backs up those software library directories would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000537</ident><fixtext fixref="F-46207r1_fix">Ensure inclusion of all SQL Server software libraries into the backup process.</fixtext><fix id="F-46207r1_fix" /><check system="C-47580r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review evidence of inclusion of SQL Server software libraries in current backup records.
+A mixture of full and incremental server-level backups by a third-party tool that backs up those software library directories would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000537</ident><fixtext fixref="F-46207r1_fix">Ensure inclusion of all SQL Server software libraries into the backup process.</fixtext><fix id="F-46207r1_fix" /><check system="C-47580r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review evidence of inclusion of SQL Server software libraries in current backup records.
 If the backup tool does not include SQL Server, this is a finding.</check-content></check></Rule></Group><Group id="V-40926"><title>SRG-APP-000146-DB-000099</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53280r2_rule" severity="medium" weight="10.0"><version>SQL2-00-018200</version><title>SQL Server backups of system-level information per organization-defined frequency must be performed that is consistent with recovery time and recovery point objectives.</title><description>&lt;VulnDiscussion&gt;SQL Server backups are a critical step in maintaining data assurance and availability.
 
 System-level information includes:  system-state information, operating system and application software, and licenses.
@@ -357,7 +357,7 @@ Backups shall be consistent with organizationally defined recovery time and reco
 
 SQL Server depends upon the availability and integrity of its system-level information. Without backups, compromise or loss of system-level information can prevent a successful recovery of SQL Server operations. If SQL Server system-level information is not backed up regularly this risks the loss of SQL Server data in the event of a system failure.
 
-A mixture of full and incrementally server level backups that backup the system-level information would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000537</ident><fixtext fixref="F-46208r1_fix">Deploy a backup solution to perform backups as per organizationally defined Backup Policy.</fixtext><fix id="F-46208r1_fix" /><check system="C-47581r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.
+A mixture of full and incrementally server level backups that backup the system-level information would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000537</ident><fixtext fixref="F-46208r1_fix">Deploy a backup solution to perform backups as per organizationally defined Backup Policy.</fixtext><fix id="F-46208r1_fix" /><check system="C-47581r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.
 
 Check evidence of inclusion of system-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including system-level information backups, this is a finding.</check-content></check></Rule></Group><Group id="V-40927"><title>SRG-APP-000145-DB-000098</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53281r2_rule" severity="medium" weight="10.0"><version>SQL2-00-018100</version><title>SQL Server backup and restoration files must be protected from unauthorized access.</title><description>&lt;VulnDiscussion&gt;SQL Server backups are a critical step in maintaining data assurance and availability.
 
@@ -371,7 +371,7 @@ SQL Server can maintain local copies of critical control files to provide transp
 
 Backup files, both local to the SQL Server machine and not local to the machine, need the same protections against unauthorized access when stored on backup media as when online and actively in use by the database system. In addition, the backup media needs to be protected against physical loss.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000535</ident><fixtext fixref="F-46209r1_fix">Develop, document, and implement protection against unauthorized access of backup and restoration files.
 
-Document personnel and the level of access authorized for each to the backup and restoration files in the system documentation.</fixtext><fix id="F-46209r1_fix" /><check system="C-47582r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain authorized access list for backup and restoration procedures from system documentation.
+Document personnel and the level of access authorized for each to the backup and restoration files in the system documentation.</fixtext><fix id="F-46209r1_fix" /><check system="C-47582r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain authorized access list for backup and restoration procedures from system documentation.
 
 If documented procedures are insufficient to show or describe authorized personnel, this is a finding.
 
@@ -391,7 +391,7 @@ Problems with backup procedures or backup media may not be discovered until afte
 
 Part of an overall backup and recovery methodology includes regular recovery testing. This is very important and helps to expose any issue in the recovery process (e.g., hardware, procedures, etc.).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000535</ident><fixtext fixref="F-46210r2_fix">Develop or update recovery procedures and add the new recovery procedures to the system documentation.
 
-Plan for and test system recovery procedures and document the test.</fixtext><fix id="F-46210r2_fix" /><check system="C-47583r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review SQL Server's documented testing and recovery procedures that exist in the system documentation.
+Plan for and test system recovery procedures and document the test.</fixtext><fix id="F-46210r2_fix" /><check system="C-47583r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review SQL Server's documented testing and recovery procedures that exist in the system documentation.
 
 If the testing or recovery procedures are not documented in the system documentation, this is a finding.
 
@@ -405,7 +405,7 @@ User-level information is data generated by the information system and/or applic
 
 Applications performing backups must be configured to back up user-level information per the DoD-defined frequency.
 
-SQL Server Database backups provide the required means to restore databases after compromise or loss. Backups help reduce the vulnerability to unauthorized access or hardware loss.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000535</ident><fixtext fixref="F-46211r1_fix">Develop, document, and implement database backup procedures.</fixtext><fix id="F-46211r1_fix" /><check system="C-47584r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review the database backup procedures and implementation evidence.
+SQL Server Database backups provide the required means to restore databases after compromise or loss. Backups help reduce the vulnerability to unauthorized access or hardware loss.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000535</ident><fixtext fixref="F-46211r1_fix">Develop, document, and implement database backup procedures.</fixtext><fix id="F-46211r1_fix" /><check system="C-47584r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review the database backup procedures and implementation evidence.
 
 Evidence of implementation includes records of backup events and physical review of backup media.
 
@@ -417,7 +417,7 @@ User-level information is data generated by information system and/or applicatio
 
 Applications performing backups must be capable of backing up user-level information per the DoD defined frequency.
 
-Databases that do not backup information regularly risk the loss of that information in the event of a system failure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000535</ident><fixtext fixref="F-46212r2_fix">Deploy a backup solution to perform backups as per organizationally defined Backup Policy.</fixtext><fix id="F-46212r2_fix" /><check system="C-47585r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.
+Databases that do not backup information regularly risk the loss of that information in the event of a system failure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000535</ident><fixtext fixref="F-46212r2_fix">Deploy a backup solution to perform backups as per organizationally defined Backup Policy.</fixtext><fix id="F-46212r2_fix" /><check system="C-47585r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.
 
 Check evidence of inclusion user-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including user-level information backups, this is a finding.</check-content></check></Rule></Group><Group id="V-40932"><title>SRG-APP-000144-DB-000101</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53286r4_rule" severity="high" weight="10.0"><version>SQL2-00-017500</version><title>SQL Server must recover to a known state that is verifiable.</title><description>&lt;VulnDiscussion&gt;Application recovery and reconstitution constitutes executing an information system contingency plan comprising activities that restore essential missions and business functions.
 
@@ -443,7 +443,7 @@ To modify Initial Size (MB), click in the "Initial Size (MB)" field for the log
 
 To modify Autogrowth, click on the "Autogrowth/Maxsize" button for the log file in question, choose "In Percent" or "In Megabytes", enter value, and then click OK.
 
-To modify Maximum File Size, click on the "Autogrowth/Maxsize" button for the log file in question, choose "Limited to (MB)", enter value, and then click OK. Do not select "Unlimited".</fixtext><fix id="F-46214r6_fix" /><check system="C-47587r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server recovery procedures and technical system features to determine if mechanisms exist and are in place to specify use of trusted files during SQL Server recovery.
+To modify Maximum File Size, click on the "Autogrowth/Maxsize" button for the log file in question, choose "Limited to (MB)", enter value, and then click OK. Do not select "Unlimited".</fixtext><fix id="F-46214r6_fix" /><check system="C-47587r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server recovery procedures and technical system features to determine if mechanisms exist and are in place to specify use of trusted files during SQL Server recovery.
 
 If recovery procedures do not exist or are not sufficient to ensure recovery is done in a secure and verifiable manner, this is a finding.
 
@@ -463,17 +463,17 @@ SELECT ''?'' AS ''database name''
  WHERE type_desc = ''LOG''
    AND state = 0;
 '
-; 
+;
 
-If any transaction log files are not configured correctly for size, max_size, and growth to log sufficient transaction information, this is a finding.</check-content></check></Rule></Group><Group id="V-40933"><title>SRG-APP-000142-DB-000094</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53287r3_rule" severity="medium" weight="10.0"><version>SQL2-00-017400</version><title>SQL Server must support the organizational requirements to specifically prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 
+If any transaction log files are not configured correctly for size, max_size, and growth to log sufficient transaction information, this is a finding.</check-content></check></Rule></Group><Group id="V-40933"><title>SRG-APP-000142-DB-000094</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53287r3_rule" severity="medium" weight="10.0"><version>SQL2-00-017400</version><title>SQL Server must support the organizational requirements to specifically prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services) but doing so increases risk over limiting the services provided by any one component.  
+Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services) but doing so increases risk over limiting the services provided by any one component.
 
 To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.
 
 Database Management Systems using ports, protocols, and services deemed unsafe are open to attack through those ports, protocols, and services. This can allow unauthorized access to the database and, through the database, to other components of the information system.
 
-For detailed guidance on Ports, Protocols, and Services Management (PPSM), refer to the PPSM section of the Information Assurance Support Environment (IASE) web site, at http://iase.disa.mil/ppsm/Pages/index.aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-46215r1_fix">Disable functions, ports, protocols, and services that are not approved or are not used, but are enabled.</fixtext><fix id="F-46215r1_fix" /><check system="C-47588r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review the SQL Server configuration and settings for functions, ports, protocols, and services that are not approved or are not used, but are available.
+For detailed guidance on Ports, Protocols, and Services Management (PPSM), refer to the PPSM section of the Information Assurance Support Environment (IASE) web site, at http://iase.disa.mil/ppsm/Pages/index.aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-46215r1_fix">Disable functions, ports, protocols, and services that are not approved or are not used, but are enabled.</fixtext><fix id="F-46215r1_fix" /><check system="C-47588r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review the SQL Server configuration and settings for functions, ports, protocols, and services that are not approved or are not used, but are available.
 
 To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager.  In the left-hand pane, expand SQL Server Network Configuration.  Click on the entry for the SQL Server instance under review:  "Protocols for &lt;instance name&gt;".  The right-hand pane displays the protocols enabled for the instance.
 
@@ -489,7 +489,7 @@ DROP FUNCTION &lt;'function name'&gt;
 To remove a Stored Procedure from SQL Server, run the following SQL Script:
 DROP PROCEDURE &lt;'stored procedure name'&gt;
 
-If the user-defined Stored Procedures and Functions need to remain available, but access needs to be more restricted, then the user-defined Stored Procedures and Functions should be moved to a separate schema or database that has more restrictive access.</fixtext><fix id="F-46216r2_fix" /><check system="C-47589r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review the list of user-defined Stored Procedures and Functions by running the following SQL query:
+If the user-defined Stored Procedures and Functions need to remain available, but access needs to be more restricted, then the user-defined Stored Procedures and Functions should be moved to a separate schema or database that has more restrictive access.</fixtext><fix id="F-46216r2_fix" /><check system="C-47589r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review the list of user-defined Stored Procedures and Functions by running the following SQL query:
 EXEC sp_MSforeachdb
 '
 DECLARE @nCount integer;
@@ -507,9 +507,9 @@ SELECT ''?'' AS ''Table Name'', *
 '
 ;
 
-If any user-defined Stored Procedures and Functions are unauthorized and therefore should be prohibited or restricted and are not, this is a finding.</check-content></check></Rule></Group><Group id="V-40935"><title>SRG-APP-000141-DB-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53289r2_rule" severity="medium" weight="10.0"><version>SQL2-00-017200</version><title>Access to xp_cmdshell must be disabled.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
+If any user-defined Stored Procedures and Functions are unauthorized and therefore should be prohibited or restricted and are not, this is a finding.</check-content></check></Rule></Group><Group id="V-40935"><title>SRG-APP-000141-DB-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53289r2_rule" severity="medium" weight="10.0"><version>SQL2-00-017200</version><title>Access to xp_cmdshell must be disabled.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements; or providing a wide array of functionality not required for every mission, but which cannot be disabled. 
+It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements; or providing a wide array of functionality not required for every mission, but which cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
@@ -526,7 +526,7 @@ EXEC sp_configure 'xp_cmdshell', 0
 GO
 
 RECONFIGURE
-GO</fixtext><fix id="F-46217r2_fix" /><check system="C-47590r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>To determine if xp_cmdshell is enabled, execute the following commands:
+GO</fixtext><fix id="F-46217r2_fix" /><check system="C-47590r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>To determine if xp_cmdshell is enabled, execute the following commands:
 
 EXEC SP_CONFIGURE 'show advanced option', '1';
 RECONFIGURE WITH OVERRIDE;
@@ -542,12 +542,12 @@ Some applications that run on SQL Server require the 'sa' account to be enabled
 
 USE master;
 GO
-ALTER LOGIN [sa] DISABLE;</fixtext><fix id="F-46218r3_fix" /><check system="C-47591r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check SQL Server settings to determine if the 'sa' (sysadmin) account has been disabled by executing the following query:
+ALTER LOGIN [sa] DISABLE;</fixtext><fix id="F-46218r3_fix" /><check system="C-47591r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check SQL Server settings to determine if the 'sa' (sysadmin) account has been disabled by executing the following query:
 
 USE MASTER
 GO
-SELECT name, is_disabled 
-FROM sys.sql_logins 
+SELECT name, is_disabled
+FROM sys.sql_logins
 WHERE principal_id = 1;
 
 Verify that the "name" column contains the current name of the sa database server account (see note).
@@ -562,17 +562,17 @@ Applications must adhere to the principles of least functionality by providing o
 
 Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46219r2_fix">If any components or features of SQL Server are required for operation of applications that will be accessing SQL Server data or configuration, include them in the system documentation.
 
-If any unused components or features of SQL Server are installed and cannot be uninstalled or removed, then disable those components or features.</fixtext><fix id="F-46219r2_fix" /><check system="C-47592r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.).  Take note of those which are enabled.
+If any unused components or features of SQL Server are installed and cannot be uninstalled or removed, then disable those components or features.</fixtext><fix id="F-46219r2_fix" /><check system="C-47592r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.).  Take note of those which are enabled.
 
 Review the system documentation to verify that the enabled components or features are documented and authorized.  If any enabled components or features are not authorized, this is a finding.</check-content></check></Rule></Group><Group id="V-40938"><title>SRG-APP-000141-DB-000091</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53292r2_rule" severity="medium" weight="10.0"><version>SQL2-00-016800</version><title>SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. 
+It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
 Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.
 
-SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46220r1_fix">Remove the SQL Server Analysis Service (SSAS) software component.</fixtext><fix id="F-46220r1_fix" /><check system="C-47593r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If the SQL Server service "SQL Server Analysis Services (MSSQLSERVER)" is used and the service satisfies functional organizational requirement, this is not a finding.
+SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46220r1_fix">Remove the SQL Server Analysis Service (SSAS) software component.</fixtext><fix id="F-46220r1_fix" /><check system="C-47593r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If the SQL Server service "SQL Server Analysis Services (MSSQLSERVER)" is used and the service satisfies functional organizational requirement, this is not a finding.
 
 If there is no functional organizational requirement for the "SQL Server Analysis Services (MSSQLSERVER)" service make sure that the service is not installed or is disabled.
 
@@ -588,7 +588,7 @@ Applications must adhere to the principles of least functionality by providing o
 
 Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.
 
-SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46221r1_fix">Remove the SQL Server Integrated Services (SSIS) software component.</fixtext><fix id="F-46221r1_fix" /><check system="C-47594r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If the SQL Server service "SQL Server Integration Services 11.0" is used and the service satisfies functional organizational requirement, this is not a finding.
+SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46221r1_fix">Remove the SQL Server Integrated Services (SSIS) software component.</fixtext><fix id="F-46221r1_fix" /><check system="C-47594r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If the SQL Server service "SQL Server Integration Services 11.0" is used and the service satisfies functional organizational requirement, this is not a finding.
 
 If there is no functional organizational requirement for the "SQL Server Integration Services 11.0" service make sure that the service is not installed or is disabled.
 
@@ -604,7 +604,7 @@ Applications must adhere to the principles of least functionality by providing o
 
 Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.
 
-SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46222r1_fix">Remove the SSRS from SQL Server.</fixtext><fix id="F-46222r1_fix" /><check system="C-47595r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If there is no functional organizational requirement for the "SQL Server Reporting Services (MSSQLSERVER)" service, make sure that the service is not installed or that the service is disabled.
+SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46222r1_fix">Remove the SSRS from SQL Server.</fixtext><fix id="F-46222r1_fix" /><check system="C-47595r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If there is no functional organizational requirement for the "SQL Server Reporting Services (MSSQLSERVER)" service, make sure that the service is not installed or that the service is disabled.
 
 If the SQL Server service "SQL Server Reporting Services (MSSQLSERVER)" is used and the service satisfies functional organizational requirement, this is not a finding.
 
@@ -613,9 +613,9 @@ From command prompt, using an account with System Administrator Privilege, open
 
 If the "SQL Server Reporting Services (MSSQLSERVER)" service does not exist, this is not a finding.
 
-If the "SQL Server Reporting Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not set to "Disabled", this is a finding.</check-content></check></Rule></Group><Group id="V-40941"><title>SRG-APP-000141-DB-000091</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53295r2_rule" severity="high" weight="10.0"><version>SQL2-00-016500</version><title>SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
+If the "SQL Server Reporting Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not set to "Disabled", this is a finding.</check-content></check></Rule></Group><Group id="V-40941"><title>SRG-APP-000141-DB-000091</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53295r2_rule" severity="high" weight="10.0"><version>SQL2-00-016500</version><title>SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused.</title><description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. 
+It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
@@ -629,7 +629,7 @@ If it is not required, using an account with System Administrator privileges, fr
 Navigate to Programs and Features. Remove the following entries in the 'Uninstall or change a program' window.
 
 Microsoft SQL Server Data Tools - Database Projects - Web installer entry point
-Prerequisites for SSDT</fixtext><fix id="F-46223r2_fix" /><check system="C-47596r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review the list of components and features installed with the database. Using an account with System Administrator privileges, from Command Prompt, open control.exe.
+Prerequisites for SSDT</fixtext><fix id="F-46223r2_fix" /><check system="C-47596r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review the list of components and features installed with the database. Using an account with System Administrator privileges, from Command Prompt, open control.exe.
 
 Navigate to Programs and Features. Check for the following entries in the 'Uninstall or change a program' window.
 
@@ -644,7 +644,7 @@ Applications must adhere to the principles of least functionality by providing o
 
 Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46224r1_fix">Remove the publicly available "AdventureWorks" database from SQL Server by running the following query:
 
-DROP DATABASE AdventureWorks</fixtext><fix id="F-46224r1_fix" /><check system="C-47597r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check SQL Server for the existence of the publicly available "AdventureWorks" database by performing the following query:
+DROP DATABASE AdventureWorks</fixtext><fix id="F-46224r1_fix" /><check system="C-47597r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check SQL Server for the existence of the publicly available "AdventureWorks" database by performing the following query:
 
 SELECT name from sysdatabases where name like 'AdventureWorks%';
 
@@ -657,7 +657,7 @@ Applications must adhere to the principles of least functionality by providing o
 Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-46225r1_fix">Remove the publicly available "Northwind" database from SQL Server by running the following query:
 
 
-DROP DATABASE Northwind</fixtext><fix id="F-46225r1_fix" /><check system="C-47598r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check SQL Server for the existence of the publicly available "NorthWind" database by performing the following query:
+DROP DATABASE Northwind</fixtext><fix id="F-46225r1_fix" /><check system="C-47598r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check SQL Server for the existence of the publicly available "NorthWind" database by performing the following query:
 
 SELECT name from sysdatabases where name like 'Northwind%';
 
@@ -716,9 +716,9 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 8) Click "OK"
 9) Permission like a normal user from here
 
-Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. 
+Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.
 
-Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.)</fixtext><fix id="F-46226r15_fix" /><check system="C-47599r15_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location:
+Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.)</fixtext><fix id="F-46226r15_fix" /><check system="C-47599r15_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location:
 HKEY_LOCAL_MACHINE
 &gt;&gt; SOFTWARE
 &gt;&gt; Microsoft
@@ -799,16 +799,16 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 8) Click "OK"
 9) Permission like a normal user from here
 
-Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. 
+Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.
 
 Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.)
-</check-content></check></Rule></Group><Group id="V-40945"><title>SRG-APP-000133-DB-000205</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53299r3_rule" severity="high" weight="10.0"><version>SQL2-00-015700</version><title>Vendor-supported software and patches must be evaluated and patched against newly found vulnerabilities.</title><description>&lt;VulnDiscussion&gt;Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.
+</check-content></check></Rule></Group><Group id="V-40945"><title>SRG-APP-000133-DB-000205</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53299r4_rule" severity="high" weight="10.0"><version>SQL2-00-015700</version><title>Vendor-supported software and patches must be evaluated and patched against newly found vulnerabilities.</title><description>&lt;VulnDiscussion&gt;Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.
 
 Any time new software code is introduced to a system there is the potential for unintended consequences. There have been documented instances where the application of a patch has caused problems with system integrity or availability. Due to information system integrity and availability concerns, organizations must give careful consideration to the methodology used to carry out automatic updates.
 
 If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46227r2_fix">Upgrade SQL Server to the Microsoft-supported version.
 
-Apply the latest SQL Server patches after evaluation of impact.</fixtext><fix id="F-46227r2_fix" /><check system="C-47600r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check Microsoft's list of supported SQL Server versions.  To locate the correct web page, perform a web search for "Microsoft SQL Server end of support."
+Apply the latest SQL Server patches after evaluation of impact.</fixtext><fix id="F-46227r2_fix" /><check system="C-47600r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check Microsoft's list of supported SQL Server versions. To locate the correct web page, perform a web search for "Microsoft SQL Server end of support."
 
 To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerabilities.
 
@@ -817,9 +817,13 @@ print @@version
 
 If the security patch support for SQL Server cannot be determined or SQL Server version is not shown as supported, this is a finding.
 
-If SQL Server does not contain the latest security patches, this is a finding.</check-content></check></Rule></Group><Group id="V-40946"><title>SRG-APP-000133-DB-000199</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53300r4_rule" severity="low" weight="10.0"><version>SQL2-00-015500</version><title>Database software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.</title><description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. 
+If SQL Server does not contain the latest security patches, this is a finding.
+
+SQL Server 2012 Service Pack 3 support end date: 10/9/2018
+SQL Server 2012 Enterprise Core mainstream support end date: 7/11/2018
+SQL Server 2012 Enterprise Core extended support end date: 7/12/2022</check-content></check></Rule></Group><Group id="V-40946"><title>SRG-APP-000133-DB-000199</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53300r4_rule" severity="low" weight="10.0"><version>SQL2-00-015500</version><title>Database software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.</title><description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
 
-Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46228r1_fix">Separate database files (software, data) into dedicated directories.</fixtext><fix id="F-46228r1_fix" /><check system="C-47601r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Verify the SQL Server installations present on the server.
+Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-46228r1_fix">Separate database files (software, data) into dedicated directories.</fixtext><fix id="F-46228r1_fix" /><check system="C-47601r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Verify the SQL Server installations present on the server.
 
 From a Command Prompt, type regedit.exe, and press [ENTER].
 
@@ -829,15 +833,15 @@ Analysis Services Instances are registered in the OLAP subfolder.
 Reporting Services Instances are registered in the RS subfolder.
 Standard SQL Server Instances are registered in the SQL subfolder.
 
-Inside each of these folders, a single key is used to reference an Instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: 
+Inside each of these folders, a single key is used to reference an Instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location:
 
 HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME].
 
-An [INSTANCE NAME] is listed as the Data component of a key found in one of the above OLAP, RS, or SQL folders.  
+An [INSTANCE NAME] is listed as the Data component of a key found in one of the above OLAP, RS, or SQL folders.
 
 To find the installation location of a particular instance, navigate to the following location in the Windows Registry:
 
-HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME] &gt;&gt; Setup.  
+HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME] &gt;&gt; Setup.
 
 Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance.
 
@@ -856,7 +860,7 @@ DBA and other privileged administrative or application owner accounts are grante
 
 Configure SQL Server &amp; OS settings and access controls, to restrict user access to objects and data that the user is authorized to view or interact with.
 
-Develop, document, and implement procedures to restrict use of the DBMS software installation account.</fixtext><fix id="F-46229r2_fix" /><check system="C-47602r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check system documentation for policy and procedures to restrict use of the SQL Server software installation account.
+Develop, document, and implement procedures to restrict use of the DBMS software installation account.</fixtext><fix id="F-46229r2_fix" /><check system="C-47602r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check system documentation for policy and procedures to restrict use of the SQL Server software installation account.
 
 
 Check OS settings to determine whether users are restricted from accessing SQL Server objects and data they are not authorized to access by checking the local OS user accounts.
@@ -875,7 +879,7 @@ Unmanaged changes that occur to the software libraries or configuration can lead
 Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.
 &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001493</ident><ident system="http://iase.disa.mil/cci">CCI-001494</ident><ident system="http://iase.disa.mil/cci">CCI-001495</ident><ident system="http://iase.disa.mil/cci">CCI-002716</ident><ident system="http://iase.disa.mil/cci">CCI-002718</ident><fixtext fixref="F-46230r8_fix">Include locations of all files, libraries, scripts, and executables that are part of, or related to, the SQL Server 2012 installation in the documentation.
 
-Deploy a security and data integrity tool for monitoring and alerting files and folders based on cryptographic hashes, to verify files/folder locations as listed in the documentation.</fixtext><fix id="F-46230r8_fix" /><check system="C-47603r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If a security and data integrity tool is not used for monitoring and alerting files and folders based on cryptographic hashes, this is a finding.
+Deploy a security and data integrity tool for monitoring and alerting files and folders based on cryptographic hashes, to verify files/folder locations as listed in the documentation.</fixtext><fix id="F-46230r8_fix" /><check system="C-47603r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If a security and data integrity tool is not used for monitoring and alerting files and folders based on cryptographic hashes, this is a finding.
 
 If the tool does not verify files/folder locations as listed in the documentation, this is a finding.</check-content></check></Rule></Group><Group id="V-40949"><title>SRG-APP-000133-DB-000179</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53303r2_rule" severity="medium" weight="10.0"><version>SQL2-00-015300</version><title>SQL Server must monitor for security-relevant configuration settings to discover unauthorized changes.</title><description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to security-relevant configuration settings of SQL Server can potentially have significant effects on the overall security of the system.
 
@@ -887,17 +891,17 @@ Unmanaged changes that occur to SQL Server software libraries or configuration c
 
 Document the specific users or types of security personnel that are able to monitor security-relevant configuration settings to discover unauthorized changes.
 
-Deploy and implement a third-party tool or some other SQL Server method of monitoring security-relevant configuration settings to discover unauthorized changes.</fixtext><fix id="F-46231r2_fix" /><check system="C-47604r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Verify within the system documentation that SQL Server is monitoring for security-relevant configuration settings to discover unauthorized changes.
+Deploy and implement a third-party tool or some other SQL Server method of monitoring security-relevant configuration settings to discover unauthorized changes.</fixtext><fix id="F-46231r2_fix" /><check system="C-47604r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Verify within the system documentation that SQL Server is monitoring for security-relevant configuration settings to discover unauthorized changes.
 
-This can be done by a third-party tool or a SQL script that does baselining and then comparisons. 
+This can be done by a third-party tool or a SQL script that does baselining and then comparisons.
 
-If the monitoring of security-relevant configuration settings to discover unauthorized changes is not implemented on SQL Server, this is a finding.</check-content></check></Rule></Group><Group id="V-40950"><title>SRG-APP-000130-DB-000088</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53304r3_rule" severity="medium" weight="10.0"><version>SQL2-00-014700</version><title>SQL Server must support the employment of automated mechanisms supporting the auditing of the enforcement actions.</title><description>&lt;VulnDiscussion&gt;Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. 
+If the monitoring of security-relevant configuration settings to discover unauthorized changes is not implemented on SQL Server, this is a finding.</check-content></check></Rule></Group><Group id="V-40950"><title>SRG-APP-000130-DB-000088</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53304r3_rule" severity="medium" weight="10.0"><version>SQL2-00-014700</version><title>SQL Server must support the employment of automated mechanisms supporting the auditing of the enforcement actions.</title><description>&lt;VulnDiscussion&gt;Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
 
-Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. 
+Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
 
-Access restrictions for change also include software libraries. 
+Access restrictions for change also include software libraries.
 
-Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover).  
+Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover).
 
 This requirement focuses on the auditing aspect of the protections.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001814</ident><fixtext fixref="F-46232r5_fix">Navigate to Advanced Security Settings by selecting Properties &gt; Security &gt; Advanced &gt; Auditing &gt; Continue.
 
@@ -908,7 +912,7 @@ Where "Everyone" is in the "Name" column, select that row and click on the Edit
 In the Auditing Entry dialog, set "Apply onto" to "This folder, subfolders and files".
 
 In the Auditing Entry dialog, select both the Successful and the Failed checkbox for each of the following access types, where not already selected:
-    Traverse folder/execute file 
+    Traverse folder/execute file
     List folder/read data
     Read attributes
     Read extended attributes
@@ -919,9 +923,9 @@ In the Auditing Entry dialog, select both the Successful and the Failed checkbox
     Delete
     Read permissions
 
-Click OK, OK, OK, OK to save the new settings and exit the dialog boxes.</fixtext><fix id="F-46232r5_fix" /><check system="C-47605r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled.
+Click OK, OK, OK, OK to save the new settings and exit the dialog boxes.</fixtext><fix id="F-46232r5_fix" /><check system="C-47605r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled.
 
-Right click the root folder of the SQL Server installation.  Typically, this is at &lt;drive&gt;:\Program Files\Microsoft SQL Server\.  Select Properties. 
+Right click the root folder of the SQL Server installation.  Typically, this is at &lt;drive&gt;:\Program Files\Microsoft SQL Server\.  Select Properties.
 
 Click on the Security tab
 
@@ -936,7 +940,7 @@ If "This folder, subfolders and files" is not listed in the "Apply To" column, t
 When "Everyone" ... " is listed, select the "Everyone" row and click on the Edit button.
 
 If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding:
-    Traverse folder/execute file 
+    Traverse folder/execute file
     List folder/read data
     Read attributes
     Read extended attributes
@@ -957,7 +961,7 @@ Multiple applications can provide a cumulative negative effect. A vulnerability
 
 Relocate any directories or reinstall other application software that currently shares the DBMS software library directory to separate directories.
 
-Recommend dedicating a separate partition for the SQL software libraries.</fixtext><fix id="F-46233r2_fix" /><check system="C-47606r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server software library installation directory location.
+Recommend dedicating a separate partition for the SQL software libraries.</fixtext><fix id="F-46233r2_fix" /><check system="C-47606r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server software library installation directory location.
 
 From a command prompt, type regedit.exe, and press [ENTER].
 
@@ -969,7 +973,7 @@ Standard SQL Server Instances are registered in the SQL subfolder.
 
 Inside each one of these folders, a single key is used to reference an instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME].
 
-An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders.  
+An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders.
 
 To find the installation location of a particular instance, navigate to the following location in the Windows Registry:
  HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME] &gt;&gt; Setup.  Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance.
@@ -989,13 +993,13 @@ Audit information includes all information (e.g., audit records, audit settings,
 Deletion of database audit data could mask the theft or unauthorized modification of sensitive data stored in the database.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000164</ident><fixtext fixref="F-46234r7_fix">Modify audit file permissions to meet the requirement to protect against unauthorized deletion.
 
 Navigate to audit folder location(s) using a command prompt or Windows Explorer.  Right-click on the file, click Properties.
-On the Security tab, modify the security permissions to: 
+On the Security tab, modify the security permissions to:
 Administrator(read)
 Users (none)
 Audit Administrator(Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
 
 -----
 
@@ -1017,8 +1021,8 @@ Note 2:  Tips for adding a service SID/virtual account to a folder's permission
 7.b.i) Type "NT SERVICE\SQL" and click "Check Names"
 7.b.ii) Select the "SQLAgent$&lt;instance name&gt;" user and click OK
 8) Click OK
-9) Permission like a normal user from here</fixtext><fix id="F-46234r7_fix" /><check system="C-47607r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+9) Permission like a normal user from here</fixtext><fix id="F-46234r7_fix" /><check system="C-47607r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -1034,10 +1038,10 @@ Administrator(read)
 Users (none)
 Audit Administrator (Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
 
-If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. 
+If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding.
 
 If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding
 -----
@@ -1073,13 +1077,13 @@ Modification of database audit data could mask the theft or unauthorized modific
 
 Modify audit file permissions to meet the requirement to protect against unauthorized modification.
 
-Navigate to audit folder location(s) using a command prompt or Windows Explorer.  Right-click on the file, click Properties. On the Security tab, modify the security permissions to: 
+Navigate to audit folder location(s) using a command prompt or Windows Explorer.  Right-click on the file, click Properties. On the Security tab, modify the security permissions to:
 Administrator(read)
 Users (none)
 Audit Administrator(Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
 
 -----
 
@@ -1101,8 +1105,8 @@ Note 2:  Tips for adding a service SID/virtual account to a folder's permission
 7.b.i) Type "NT SERVICE\SQL" and click "Check Names"
 7.b.ii) Select the "SQLAgent$&lt;instance name&gt;" user and click OK
 8) Click OK
-9) Permission like a normal user from here</fixtext><fix id="F-46235r7_fix" /><check system="C-47608r9_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+9) Permission like a normal user from here</fixtext><fix id="F-46235r7_fix" /><check system="C-47608r9_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -1118,10 +1122,10 @@ Administrator(read)
 Users (none)
 Audit Administrator (Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
 
-If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. 
+If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding.
 
 If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding.
 
@@ -1138,7 +1142,7 @@ Audit information includes all information (e.g., audit records, audit settings,
 Modify audit file permissions to meet the requirement to protect against unauthorized access.
 
 Navigate to audit folder location(s) using a command prompt or Windows Explorer.  Right-click on the file, click Properties.
-On the Security tab, modify the security permissions to: 
+On the Security tab, modify the security permissions to:
 Administrator(read)
 Users (none)
 Audit Administrator(Full Control)
@@ -1167,8 +1171,8 @@ Note 2:  Tips for adding a service SID/virtual account to a folder's permission
 7.b.i) Type "NT SERVICE\SQL" and click "Check Names"
 7.b.ii) Select the "SQLAgent$&lt;instance name&gt;" user and click OK
 8) Click OK
-9) Permission like a normal user from here</fixtext><fix id="F-46314r8_fix" /><check system="C-47632r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+9) Permission like a normal user from here</fixtext><fix id="F-46314r8_fix" /><check system="C-47632r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -1184,11 +1188,11 @@ Administrator(read)
 Users (none)
 Audit Administrator (Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2]
 
 
-If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. 
+If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding.
 
 If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding.
 
@@ -1222,7 +1226,7 @@ Reducing the risk of audit compromises by privileged users can also be achieved,
 If an attacker were to gain access to audit tools, they could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-001351</ident><fixtext fixref="F-46315r7_fix">Modify audit file permissions to meet the requirement to protect against unauthorized access.
 
 Navigate to the audit folder location(s) using a command prompt or Windows Explorer.  Right-click on the file, click Properties.
-On the Security tab, modify the security permissions to: 
+On the Security tab, modify the security permissions to:
 Administrator(read)
 Users (none)
 Audit Administrator(Full Control)
@@ -1250,8 +1254,8 @@ Note 2:  Tips for adding a service SID/virtual account to a folder's permission
 7.b.i) Type "NT SERVICE\SQL" and click "Check Names"
 7.b.ii) Select the "SQLAgent$&lt;instance name&gt;" user and click OK
 8) Click OK
-9) Permission like a normal user from here</fixtext><fix id="F-46315r7_fix" /><check system="C-47634r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+9) Permission like a normal user from here</fixtext><fix id="F-46315r7_fix" /><check system="C-47634r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server audit file location(s) by running the following SQL script:
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -1273,22 +1277,22 @@ If any less restrictive permissions are present (and not specifically justified
 
 Detection of suspicious activity, including access attempts and successful access from unexpected places, during unexpected times, or other unusual indicators, can support decisions to apply countermeasures to deter an attack. Without detection, malicious activity may proceed without hindrance. In SQL Server's case, this is a combination of the standard audit trace, as well as the operating system logs. Only the SQL Server logs are validated for this check, as the other part is dependent upon the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000158</ident><fixtext fixref="F-46320r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46320r5_fix" /><check system="C-47638r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46320r5_fix" /><check system="C-47638r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1296,9 +1300,9 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41022"><title>SRG-APP-000107-DB-000169</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53397r3_rule" severity="medium" weight="10.0"><version>SQL2-00-012800</version><title>SQL Server must shutdown immediately in the event of an audit failure, unless an alternative audit capability exists.</title><description>&lt;VulnDiscussion&gt;It is critical that, when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. If the system were to continue processing without auditing enabled, actions could be taken on the system that could not be tracked and recorded for later forensic analysis.
 
@@ -1310,7 +1314,7 @@ Note that trace file rollover does not count as an audit failure, provided that
 
 If a trace exists, but is not set to SHUTDOWN_ON_ERROR, modify the SQL Server audit setting to immediately shutdown the database in the event of an audit failure by setting property 1 to a value of 4 or 6 for the audit.
 
-(See the SQL Server Help page for sys.sp_trace_create for implementation details.)</fixtext><fix id="F-46321r4_fix" /><check system="C-47639r10_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>From the query prompt:
+(See the SQL Server Help page for sys.sp_trace_create for implementation details.)</fixtext><fix id="F-46321r4_fix" /><check system="C-47639r10_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>From the query prompt:
 
 SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 
@@ -1319,7 +1323,7 @@ All currently defined traces for the SQL Server instance will be listed. If no t
 Determine the trace being used for the auditing requirement. Replace # in the following code with a traceid being used for the auditing requirements.
 
 From the query prompt, determine whether the trace options include the value 4, which means SHUTDOWN_ON_ERROR:
-SELECT CAST(value AS INT) 
+SELECT CAST(value AS INT)
 FROM sys.fn_trace_getinfo(#)
 where property = 1;
 
@@ -1329,24 +1333,24 @@ If a value is returned but is not 4 or 6, this is a finding.
 
 
 NOTE:  Microsoft has flagged the trace techniques and tools used in this STIG as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use and configured to satisfy this requirement, this is not a finding.  The following code can be used to check Extended Events settings.
-/********************************** 
+/**********************************
 Check to verify shutdown on failure is set.
-The following settings are what should be returned: 
-name = &lt;name of audit&gt; 
-on_failure = 1 
-on_failure_desc = SHUTDOWN SERVER INSTANCE 
-**********************************/ 
-SELECT name, on_failure, on_failure_desc 
-FROM sys.server_audits 
+The following settings are what should be returned:
+name = &lt;name of audit&gt;
+on_failure = 1
+on_failure_desc = SHUTDOWN SERVER INSTANCE
+**********************************/
+SELECT name, on_failure, on_failure_desc
+FROM sys.server_audits
 </check-content></check></Rule></Group><Group id="V-41023"><title>SRG-APP-000103-DB-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53398r2_rule" severity="low" weight="10.0"><version>SQL2-00-012600</version><title>SQL Server itself, or the logging or alerting mechanism the application utilizes, must provide a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.</title><description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Audit processing failures include:  software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
 
 If audit log capacity were to be exceeded, then events subsequently occurring will not be recorded. Organizations shall define a maximum allowable percentage of storage capacity serving as an alarming threshold (e.g., application has exceeded 80% of log storage capacity allocated) at which time the application or the logging mechanism the application utilizes will provide a warning to the appropriate personnel.
 
 A failure of database auditing will result in either the database continuing to function without auditing, or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions. This can be an alert provided by a log repository or the OS when a designated log directory is nearing capacity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001855</ident><fixtext fixref="F-46322r2_fix">From File Server Resource Manager:  Choose the From Server Selection, Select a server from the server pool, and select the server from the lower menu. Expand the File and Storage Services Role. Then Expand the File and iSCSI Services subtree. Select File Server Resource Manager. Click Add Features. Return to Add Roles and Features Wizard. Click Next. On the Features Tab, Click Next. Click Install to install and enable the FSRM.msc Microsoft Management Console Snap-in tool.
-From a Command Prompt, open fsrm.msc. Enable File and Folder Quota Management. 
+From a Command Prompt, open fsrm.msc. Enable File and Folder Quota Management.
 Create Quotas for previously identified Audit storage locations based on organizationally defined requirements.
 
-Right click the appropriate quota or quotas, and click Edit Quota Properties. From the Notification thresholds pane, create a Notification threshold for this Quota utilizing a generate email alert, or a generated Event Log entry.</fixtext><fix id="F-46322r2_fix" /><check system="C-47640r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Since SQL Server does not support the monitoring of the available audit log file space, utilize Windows File Server Resource Manager or a third-party application to perform this activity.
+Right click the appropriate quota or quotas, and click Edit Quota Properties. From the Notification thresholds pane, create a Notification threshold for this Quota utilizing a generate email alert, or a generated Event Log entry.</fixtext><fix id="F-46322r2_fix" /><check system="C-47640r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Since SQL Server does not support the monitoring of the available audit log file space, utilize Windows File Server Resource Manager or a third-party application to perform this activity.
 
 From a Command Prompt, open fsrm.msc.
 If fsrm.msc is not installed, the File Server Resource Manager is not installed, File and Folder Quota Management is not enabled. If File Server Resource Manager or a third-party tool capable of sending alert notifications based on audit log store requirements is not installed, this is a finding.
@@ -1356,7 +1360,7 @@ Expand Quota Management.
 Select Quotas.
 If Quotas have not been created for defined Audit Log storage locations that meet organizationally defined requirements, this is a finding.
 
-In the center pane, select each quota to determine its Path, Limit, Type, and Description. 
+In the center pane, select each quota to determine its Path, Limit, Type, and Description.
 
 Right click the appropriate quota or quotas, and click Edit Quota Properties.
 Examine the Notification thresholds panel. If there are no Notification thresholds applied to this Quota, this is a finding.
@@ -1368,25 +1372,25 @@ If SQL Server audit logs that are being generated exceed the amount of space res
 
 After the initial setup of SQL Server audit log configuration, it is best to check the available space frequently until the maximum number of files has been reached. Checking the available space can help determine the balance of online audit data with space required.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-46323r2_fix">Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support.
 
-Update the max_files parameter of the audits to ensure the correct number of files is defined.</fixtext><fix id="F-46323r2_fix" /><check system="C-47641r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check the SQL Server audit setting on the maximum number of files of the trace used for the auditing requirement. 
+Update the max_files parameter of the audits to ensure the correct number of files is defined.</fixtext><fix id="F-46323r2_fix" /><check system="C-47641r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check the SQL Server audit setting on the maximum number of files of the trace used for the auditing requirement.
 
-Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. 
+Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost.
 
 
-The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.   
+The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.
 If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.</check-content></check></Rule></Group><Group id="V-41025"><title>SRG-APP-000071-DB-000047</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53400r2_rule" severity="medium" weight="10.0"><version>SQL2-00-010400</version><title>SQL Server auditing configuration maximum file size must be configured to reduce the likelihood of storage capacity being exceeded, while meeting organization-defined auditing requirements.</title><description>&lt;VulnDiscussion&gt;Configure SQL Server during the installation and/or configuration process to determine if adequate storage capacity has been allocated for audit logs.
 
 If SQL Server audit logs that are being generated exceed the amount of space reserved for those logs, the system may shutdown or take other measures to stop processing in order to protect transactions from continuing unlogged.
 
-After the initial setup of SQL Server audit log configuration, it is best to check the available space until the maximum number of files has been reached. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. Therefore, the combination of max_size and max_files must be monitored to ensure that overwriting does not occur. This must also coincide with the backup process of off-loading the files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-46324r2_fix">Configure the maximum file size of each audit log file that is to be generated, staying within the file size the system was sized to support. Modify the audit in question to be placed on drives with adequate space or reconfigure to ensure the audit will not fill the space allocated.</fixtext><fix id="F-46324r2_fix" /><check system="C-47642r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check the SQL Server audit setting on the maximum file size of the trace used for the auditing requirement. 
+After the initial setup of SQL Server audit log configuration, it is best to check the available space until the maximum number of files has been reached. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. Therefore, the combination of max_size and max_files must be monitored to ensure that overwriting does not occur. This must also coincide with the backup process of off-loading the files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-46324r2_fix">Configure the maximum file size of each audit log file that is to be generated, staying within the file size the system was sized to support. Modify the audit in question to be placed on drives with adequate space or reconfigure to ensure the audit will not fill the space allocated.</fixtext><fix id="F-46324r2_fix" /><check system="C-47642r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check the SQL Server audit setting on the maximum file size of the trace used for the auditing requirement.
 
-Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. 
+Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost.
 
 
-The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.   
+The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.
 If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.</check-content></check></Rule></Group><Group id="V-41026"><title>SRG-APP-000072-DB-000046</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53401r2_rule" severity="medium" weight="10.0"><version>SQL2-00-010600</version><title>SQL Server must have allocated audit record storage capacity to meet the organization-defined requirements for saving audit record information.</title><description>&lt;VulnDiscussion&gt;SQL Server does not have the ability to be cognizant of potential audit log storage capacity issues. During the installation and/or configuration process, SQL Server should detect and determine if adequate storage capacity has been allocated for audit logs.
 
-During the installation process, a notification may be provided to the installer indicating, based on the auditing configuration chosen and the amount of storage space allocated for audit logs, the amount of storage capacity available is not sufficient to meet storage requirements. SQL Server is not able to send out notice based on adequate storage capacity allocated for the audit logs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-46325r1_fix">Use File Server Resource Manager (FSRM.msc) to enable File and Folder Quota Management and create quotas for identified Audit storage locations.</fixtext><fix id="F-46325r1_fix" /><check system="C-47643r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>From a Command Prompt, open fsrm.msc.
+During the installation process, a notification may be provided to the installer indicating, based on the auditing configuration chosen and the amount of storage space allocated for audit logs, the amount of storage capacity available is not sufficient to meet storage requirements. SQL Server is not able to send out notice based on adequate storage capacity allocated for the audit logs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-46325r1_fix">Use File Server Resource Manager (FSRM.msc) to enable File and Folder Quota Management and create quotas for identified Audit storage locations.</fixtext><fix id="F-46325r1_fix" /><check system="C-47643r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>From a Command Prompt, open fsrm.msc.
 If fsrm.msc is not installed, the File Server Resource Manager is not installed; File and Folder Quota Management is not enabled. If File Server Resource Manager or a third-party tool capable of sending alert notifications based on audit log store requirements is not installed, this is a finding.
 
 If fsrm.msc is installed, expand File Server Resource Manager in the left pane.
@@ -1398,22 +1402,22 @@ SQL Server does have a means available to add organizationally defined additiona
 
 Some organizations may determine that more detailed information is required for specific database event types. If this information is not available, it could negatively impact forensic investigations into user actions or other malicious events.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000135</ident><fixtext fixref="F-46326r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46326r5_fix" /><check system="C-47644r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46326r5_fix" /><check system="C-47644r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1421,30 +1425,30 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41028"><title>SRG-APP-000100-DB-000201</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53403r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012300</version><title>SQL Server must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41028"><title>SRG-APP-000100-DB-000201</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53403r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012300</version><title>SQL Server must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001487</ident><fixtext fixref="F-46327r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46327r5_fix" /><check system="C-47645r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46327r5_fix" /><check system="C-47645r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1452,11 +1456,11 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41029"><title>SRG-APP-000099-DB-000043</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53404r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012200</version><title>SQL Server must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41029"><title>SRG-APP-000099-DB-000043</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53404r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012200</version><title>SQL Server must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know the outcome of attempted actions. This requires specific information regarding the outcome of the action or event that the audit record is referring to. If outcome status information is not recorded and stored with the audit record, the record itself is of very limited use.
 
@@ -1464,22 +1468,22 @@ Success and failure indicators ascertain the outcome of a particular event. As s
 
 If auditing is enabled, SQL Server does capture the outcome status-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000134</ident><fixtext fixref="F-46328r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46328r5_fix" /><check system="C-47646r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46328r5_fix" /><check system="C-47646r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1487,32 +1491,32 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41030"><title>SRG-APP-000098-DB-000042</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53405r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012100</version><title>SQL Server must produce audit records containing sufficient information to establish the sources (origins) of the events.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41030"><title>SRG-APP-000098-DB-000042</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53405r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012100</version><title>SQL Server must produce audit records containing sufficient information to establish the sources (origins) of the events.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed what actions. This requires specific information regarding the source of the event an audit record is referring to. If the source of the event information is not recorded and stored with the audit record, the record itself is of very limited use.
 
 The source of the event can be a user account and sometimes a system account when timed jobs are run. Without information establishing the source of activity, the value of audit records from a forensics perspective is questionable. If auditing is enabled, SQL Server does capture the source of the event-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000133</ident><fixtext fixref="F-46329r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46329r5_fix" /><check system="C-47647r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46329r5_fix" /><check system="C-47647r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1520,32 +1524,32 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41031"><title>SRG-APP-000097-DB-000041</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53406r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012000</version><title>SQL Server must produce audit records containing sufficient information to establish where the events occurred.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41031"><title>SRG-APP-000097-DB-000041</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53406r4_rule" severity="medium" weight="10.0"><version>SQL2-00-012000</version><title>SQL Server must produce audit records containing sufficient information to establish where the events occurred.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly where actions were performed. This requires specific information regarding the event location an audit record is referring to. If event location information is not recorded and stored with the audit record, the record itself is of very limited use.
 
 An event location can be a database instance, table, column, row, etc. Without sufficient information establishing where the audit events occurred, investigation into the cause of events is severely hindered. If auditing is enabled, SQL Server does capture the event location-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000132</ident><fixtext fixref="F-46330r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46330r5_fix" /><check system="C-47648r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46330r5_fix" /><check system="C-47648r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1553,32 +1557,32 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41032"><title>SRG-APP-000096-DB-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53407r4_rule" severity="medium" weight="10.0"><version>SQL2-00-011900</version><title>SQL Server must produce audit records containing sufficient information to establish when (date and time) the events occurred.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41032"><title>SRG-APP-000096-DB-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53407r4_rule" severity="medium" weight="10.0"><version>SQL2-00-011900</version><title>SQL Server must produce audit records containing sufficient information to establish when (date and time) the events occurred.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly when actions were performed. This requires specific information regarding the date and time an audit record is referring to. If date and time information is not recorded and stored with the audit record, the record itself is of very limited use.
 
 If auditing is enabled, SQL Server does capture the date and time-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000131</ident><fixtext fixref="F-46331r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46331r5_fix" /><check system="C-47649r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46331r5_fix" /><check system="C-47649r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1586,32 +1590,32 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41033"><title>SRG-APP-000095-DB-000039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53408r4_rule" severity="medium" weight="10.0"><version>SQL2-00-011800</version><title>SQL Server must produce audit records containing sufficient information to establish what type of events occurred.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41033"><title>SRG-APP-000095-DB-000039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53408r4_rule" severity="medium" weight="10.0"><version>SQL2-00-011800</version><title>SQL Server must produce audit records containing sufficient information to establish what type of events occurred.</title><description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly what actions were performed. This requires specific information regarding the event type an audit record is referring to. If event type information is not recorded and stored with the audit record, the record itself is of very limited use.
 
 If auditing is enabled, SQL Server does capture the event type-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-46332r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46332r5_fix" /><check system="C-47650r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46332r5_fix" /><check system="C-47650r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1619,9 +1623,9 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41034"><title>SRG-APP-000080-DB-000063</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53409r4_rule" severity="low" weight="10.0"><version>SQL2-00-023700</version><title>SQL Server must protect against an individual using a shared account from falsely denying having performed a particular action.</title><description>&lt;VulnDiscussion&gt;Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
 
@@ -1637,11 +1641,11 @@ Build/configure applications to ensure successful individual authentication prio
 
 Ensure each user's identity is received and used in audit data in all relevant circumstances.
 
-Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.</fixtext><fix id="F-46333r3_fix" /><check system="C-47651r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of authorized SQL Server accounts in the system documentation.
+Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.</fixtext><fix id="F-46333r3_fix" /><check system="C-47651r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of authorized SQL Server accounts in the system documentation.
 
-If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.) 
+If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.)
 
-If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding. 
+If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding.
 
 Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured.  If shared identifiers are found, and not accompanied by individual identifiers, this is a finding.
 
@@ -1653,22 +1657,22 @@ Organizations may define the organizational personnel accountable for determinin
 
 Auditing provides accountability for changes made to the SQL Server configuration or its objects and data. It provides a means to discover suspicious activity and unauthorized changes. Without auditing, a compromise may go undetected and without a means to determine accountability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-46334r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46334r5_fix" /><check system="C-47652r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46334r5_fix" /><check system="C-47652r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -1676,15 +1680,15 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41036"><title>SRG-APP-999999-DB-000209</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53411r5_rule" severity="medium" weight="10.0"><version>SQL2-00-023600</version><title>SQL Server must be configured to use Windows Integrated Security.</title><description>&lt;VulnDiscussion&gt;SQL Server Authentication does not provide for many of the authentication requirements of the DoD. In some cases workarounds are present, but the authentication is not as robust and does not provide needed functionality. Without that functionality, SQL Server is vulnerable to authentication attacks. Consideration must be given to the placement of SQL server inside a forest to ensure evaluation of risk within the environment is considered. Risk includes introduction of risk to SQL Server from other applications or workstations as well as risk from introduction of SQL server itself into an established environment.
 
 There may be situations where SQL Server Authentication must remain enabled, because of constraints imposed by a third-party application.  In such a case, document the constraint in the system security plan, and obtain signed approval.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46335r4_fix">From SQL Server Management Studio, right-click the server, and then click Properties.
 
-Select the Security page. Under Server authentication, select Windows Authentication Mode, and then click OK.</fixtext><fix id="F-46335r4_fix" /><check system="C-47653r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>To determine the Server Authentication Mode, execute the following:
+Select the Security page. Under Server authentication, select Windows Authentication Mode, and then click OK.</fixtext><fix id="F-46335r4_fix" /><check system="C-47653r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>To determine the Server Authentication Mode, execute the following:
 
 EXEC XP_LOGINCONFIG 'login mode'
 
@@ -1694,7 +1698,7 @@ Since the SQL Server 'sa' is administrative in nature, the compromise of a defau
 
 Hit &lt;F2&gt; while the name is highlighted in order to edit the name.
 
-Rename the 'sa' account.</fixtext><fix id="F-46336r1_fix" /><check system="C-47654r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Verify the SQL Server default 'sa' account name has been changed.
+Rename the 'sa' account.</fixtext><fix id="F-46336r1_fix" /><check system="C-47654r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Verify the SQL Server default 'sa' account name has been changed.
 
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins.
 
@@ -1704,14 +1708,14 @@ Use of privileged accounts for non-administrative purposes puts data at risk of
 
 The SQL Server installation account requires privileges not required for SQL Server administration or other functions. Use of accounts configured with excess privileges may result in the loss or compromise of data or system settings due to elevated privileges that bypass controls designed to protect them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46337r1_fix">Restrict usage of the SQL Server installation account to SQL Server installation, upgrade, and maintenance actions only.
 
-Disable installation accounts when authorized actions are not being performed.</fixtext><fix id="F-46337r1_fix" /><check system="C-47655r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review system documentation to identify the installation account. Verify whether the account is used for anything beyond SQL Server software installation, upgrade, and maintenance actions.
+Disable installation accounts when authorized actions are not being performed.</fixtext><fix id="F-46337r1_fix" /><check system="C-47655r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review system documentation to identify the installation account. Verify whether the account is used for anything beyond SQL Server software installation, upgrade, and maintenance actions.
 
 If the account is used for anything beyond SQL Server installation, upgrade, and maintenance actions, this is a finding.</check-content></check></Rule></Group><Group id="V-41039"><title>SRG-APP-000063-DB-000021</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53414r4_rule" severity="medium" weight="10.0"><version>SQL2-00-010000</version><title>DBA OS or domain accounts must be granted only those host system privileges necessary for the administration of SQL Server.</title><description>&lt;VulnDiscussion&gt;SQL Server DBAs, if assigned excessive OS privileges, could perform actions that could endanger the information system or hide evidence of malicious activity.
 
 This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements.  They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46338r4_fix">
 Remove any unnecessary privileges and any unauthorized members from the Group(s) representing DBAs.
 
-Remove any unnecessary Group memberships from the user accounts representing DBAs.</fixtext><fix id="F-46338r4_fix" /><check system="C-47656r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s).
+Remove any unnecessary Group memberships from the user accounts representing DBAs.</fixtext><fix id="F-46338r4_fix" /><check system="C-47656r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s).
 
 
 To review local accounts and groups:
@@ -1741,7 +1745,7 @@ To limit exposure when operating from within a privileged account or role, the a
 
 Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to misassignment of privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in, and provided by, applications.
 
-External applications called by SQL Server may be executed under OS or domain accounts with unnecessary privileges. This can lead to unauthorized access to OS resources and compromise of the OS, SQL Server, or any other services provided by the host platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46339r2_fix">Limit privileges to SQL Server-related OS and domain accounts to those required privileges needed to perform their SQL Server-specific functionality.</fixtext><fix id="F-46339r2_fix" /><check system="C-47657r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Determine which OS or domain accounts are used by SQL Server to run external procedures. Validate that these accounts have only the privileges necessary to perform the required functionality.
+External applications called by SQL Server may be executed under OS or domain accounts with unnecessary privileges. This can lead to unauthorized access to OS resources and compromise of the OS, SQL Server, or any other services provided by the host platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46339r2_fix">Limit privileges to SQL Server-related OS and domain accounts to those required privileges needed to perform their SQL Server-specific functionality.</fixtext><fix id="F-46339r2_fix" /><check system="C-47657r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Determine which OS or domain accounts are used by SQL Server to run external procedures. Validate that these accounts have only the privileges necessary to perform the required functionality.
 
 If any OS or domain accounts utilized by SQL Server are running external procedures and have privileges beyond those required for running the external procedures, this is a finding.</check-content></check></Rule></Group><Group id="V-41041"><title>SRG-APP-000063-DB-000019</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53416r2_rule" severity="medium" weight="10.0"><version>SQL2-00-009800</version><title>SQL Server DBA roles must not be assigned excessive or unauthorized privileges.</title><description>&lt;VulnDiscussion&gt;This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
 
@@ -1761,7 +1765,7 @@ Remove 'Server Roles' permissions from DBAs and other administrative users that
 
 Navigate from 'Server Roles' to 'Users mapped to the login'.
 
-Remove 'Users mapped to the login' permissions from DBAs and other administrative users that are beyond what is required.</fixtext><fix id="F-46340r2_fix" /><check system="C-47658r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of all DBAs.
+Remove 'Users mapped to the login' permissions from DBAs and other administrative users that are beyond what is required.</fixtext><fix id="F-46340r2_fix" /><check system="C-47658r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of all DBAs.
 Obtain documented role assignments for each DBA.
 Obtain from system documentation or use SQL Server to determine privilege assignment of user-defined roles.
 
@@ -1777,7 +1781,7 @@ Navigate from 'Server Roles' to 'Users mapped to the login'.
 
 If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding.</check-content></check></Rule></Group><Group id="V-41042"><title>SRG-APP-000063-DB-000018</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53417r5_rule" severity="medium" weight="10.0"><version>SQL2-00-009700</version><title>All use of privileged accounts must be audited.</title><description>&lt;VulnDiscussion&gt;This is intended to limit exposure, by making it possible to trace any unauthorized access to other data or functionality by a privileged user account or role that has permissions on security functions or security-relevant information.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-46341r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46341r5_fix" /><check system="C-47659r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46341r5_fix" /><check system="C-47659r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
 
 SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
@@ -1823,7 +1827,7 @@ USE master
 ALTER SERVER ROLE [&lt;'server role name'&gt;] DROP MEMBER &lt;'user name'&gt;
 GO
 
-Provide administrators with separate accounts for administration and regular accounts for non-administrator activity.</fixtext><fix id="F-46342r2_fix" /><check system="C-47660r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain a list of SQL Server DBAs or other administrative accounts. Run the following SQL script to check all users’ permissions:
+Provide administrators with separate accounts for administration and regular accounts for non-administrator activity.</fixtext><fix id="F-46342r2_fix" /><check system="C-47660r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain a list of SQL Server DBAs or other administrative accounts. Run the following SQL script to check all users’ permissions:
 
 SELECT SP1.[name] AS 'Login', 'Role: ' + SP2.[name] COLLATE DATABASE_DEFAULT AS 'ServerPermission'
 FROM sys.server_principals SP1
@@ -1844,7 +1848,7 @@ If any DBA or administrator has authorization for non- administrative access to
 
 To aid in tracking and administering such permissions, individual logins must not be directly granted permissions or built-in server roles.  Instead, user-defined server roles must be created, with the permissions and built-in server roles granted to them; the individual logins must be assigned to the appropriate user-defined server roles.
 
-The built-in server role "sysadmin" is a partial exception.  This cannot be granted to a user-defined role, only to a login account.  Most (not necessarily all) database administrators will need to be members of sysadmin.  Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable.  The users who require such access must be documented and approved.  
+The built-in server role "sysadmin" is a partial exception.  This cannot be granted to a user-defined role, only to a login account.  Most (not necessarily all) database administrators will need to be members of sysadmin.  Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable.  The users who require such access must be documented and approved.
 
 In addition, if the site uses backup-restore software that connects to SQL Server via the Virtual Device Interface (VDI), the account used by that software must have the sysadmin role.  (See Microsoft Knowledge Base article 2926557, http://support.microsoft.com/kb/2926557).  If this applies, it must be documented and approved.
 
@@ -2036,7 +2040,7 @@ Remove Server Roles permissions from user account.
 
 Navigate from Server Roles to Users Mapping.
 
-Remove direct permissions on db_accessadmin, db_backupoperator, db_datareader, db_datawriter, db_ddladmin, db_denydatareader, db_denydatawriter, db_owner, and db_securityadmin from user account.</fixtext><fix id="F-46343r5_fix" /><check system="C-47661r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Use SQL Server and system documentation to determine privilege assignment of user-defined roles.
+Remove direct permissions on db_accessadmin, db_backupoperator, db_datareader, db_datawriter, db_ddladmin, db_denydatareader, db_denydatawriter, db_owner, and db_securityadmin from user account.</fixtext><fix id="F-46343r5_fix" /><check system="C-47661r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Use SQL Server and system documentation to determine privilege assignment of user-defined roles.
 
 Determine which user-defined roles grant privileges to system tables and configuration data stored in SQL Server.
 
@@ -2072,7 +2076,7 @@ db_denydatawriter
 db_owner
 db_securityadmin</check-content></check></Rule></Group><Group id="V-41045"><title>SRG-APP-000062-DB-000012</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53420r2_rule" severity="medium" weight="10.0"><version>SQL2-00-009100</version><title>A single SQL Server database connection configuration file (or a single set of credentials) must not be used to configure all database clients.</title><description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
-Many sites distribute a single SQL Server connection configuration file to all site database users that contains network access information for all databases on the site. Such a file provides information to access SQL Server databases not required by all users that may assist in unauthorized access attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-002220</ident><fixtext fixref="F-46344r1_fix">Implement procedures to supply SQL Server database connection information to only those databases authorized for the user.</fixtext><fix id="F-46344r1_fix" /><check system="C-47662r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check procedures for providing SQL Server database connection information to users/applications. If procedures do not indicate or implement restrictions to connections required by the particular user/application which indicate process of least privilege and specific authorization was employed, this is a finding.</check-content></check></Rule></Group><Group id="V-41046"><title>SRG-APP-000062-DB-000011</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53421r2_rule" severity="medium" weight="10.0"><version>SQL2-00-009000</version><title>SQL Server must restrict access to sensitive information to authorized user roles.</title><description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
+Many sites distribute a single SQL Server connection configuration file to all site database users that contains network access information for all databases on the site. Such a file provides information to access SQL Server databases not required by all users that may assist in unauthorized access attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-002220</ident><fixtext fixref="F-46344r1_fix">Implement procedures to supply SQL Server database connection information to only those databases authorized for the user.</fixtext><fix id="F-46344r1_fix" /><check system="C-47662r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check procedures for providing SQL Server database connection information to users/applications. If procedures do not indicate or implement restrictions to connections required by the particular user/application which indicate process of least privilege and specific authorization was employed, this is a finding.</check-content></check></Rule></Group><Group id="V-41046"><title>SRG-APP-000062-DB-000011</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53421r2_rule" severity="medium" weight="10.0"><version>SQL2-00-009000</version><title>SQL Server must restrict access to sensitive information to authorized user roles.</title><description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
 Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-002220</ident><fixtext fixref="F-46345r2_fix">Add the user-defined server role to the system documentation.
 
@@ -2088,7 +2092,7 @@ REVOKE &lt;'server role name'&gt; TO [&lt;'server role name'&gt;]
 
 Rename the user-defined role by running the following script:
 USE master
-ALTER SERVER ROLE [&lt;'old role name'&gt;] WITH NAME = [&lt;'new role name'&gt;]</fixtext><fix id="F-46345r2_fix" /><check system="C-47663r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of available user-defined server roles from system documentation.
+ALTER SERVER ROLE [&lt;'old role name'&gt;] WITH NAME = [&lt;'new role name'&gt;]</fixtext><fix id="F-46345r2_fix" /><check system="C-47663r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of available user-defined server roles from system documentation.
 
 Obtain the list of available user-defined server roles from the SQL Server system by running the following script:
 /**********************************************************************************
@@ -2139,24 +2143,24 @@ Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'
 
 If any user-defined role contains permissions that are inconsistent with separation sensitive information assignment, this is a finding.
 
-If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding.</check-content></check></Rule></Group><Group id="V-41047"><title>SRG-APP-000062-DB-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53422r4_rule" severity="medium" weight="10.0"><version>SQL2-00-008900</version><title>SQL Server processes or services must run under custom, dedicated OS or domain accounts.</title><description>&lt;VulnDiscussion&gt;Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. 
+If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding.</check-content></check></Rule></Group><Group id="V-41047"><title>SRG-APP-000062-DB-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53422r4_rule" severity="medium" weight="10.0"><version>SQL2-00-008900</version><title>SQL Server processes or services must run under custom, dedicated OS or domain accounts.</title><description>&lt;VulnDiscussion&gt;Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action.
 
-The concept of separation of duties extends to processes.  The DBMS must run under a custom, dedicated OS or domain account.  When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions.  Similarly, related services must run under dedicated accounts where this is possible.  The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx  and  http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-002220</ident><fixtext fixref="F-46346r2_fix">Configure the SQL Server services to use a custom, dedicated OS or domain account.</fixtext><fix id="F-46346r2_fix" /><check system="C-47664r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check OS settings to determine whether SQL Server processes are running under a dedicated OS or domain account. If the SQL Server processes are running under shared accounts, this is a finding.
+The concept of separation of duties extends to processes.  The DBMS must run under a custom, dedicated OS or domain account.  When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions.  Similarly, related services must run under dedicated accounts where this is possible.  The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx  and  http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-002220</ident><fixtext fixref="F-46346r2_fix">Configure the SQL Server services to use a custom, dedicated OS or domain account.</fixtext><fix id="F-46346r2_fix" /><check system="C-47664r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check OS settings to determine whether SQL Server processes are running under a dedicated OS or domain account. If the SQL Server processes are running under shared accounts, this is a finding.
 
 From a Command Prompt, type services.msc, and press [ENTER]. Scroll down to the SQL Server Services. SQL Server Services begin with SQL.  The following services, when present, should be listed as follows:
 
-Service Name:                    Log On As:
-SQL Full-text Filter Daemon Launcher:        NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server [stand-alone]:            NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server [cluster]:                &lt;domain&gt;\&lt;CustomServiceAccount&gt;
-SQL Server Agent:                NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Analysis Services:            NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Browser:                Local Service
-SQL Server Distributed Replay Client:        NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Distributed Replay Controller:    NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Integration Services 11.0:        NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Reporting Services:            NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server VSS Writer:                Local System
+Service Name:     Log On As:
+SQL Full-text Filter Daemon Launcher:  NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server [stand-alone]:   NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server [cluster]:    &lt;domain&gt;\&lt;CustomServiceAccount&gt;
+SQL Server Agent:    NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Analysis Services:   NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Browser:    Local Service
+SQL Server Distributed Replay Client:  NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Distributed Replay Controller: NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Integration Services 11.0:  NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Reporting Services:   NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server VSS Writer:    Local System
 
 UNIQUE CUSTOM ACCOUNT refers to an account with which no other service listed in the services.msc window is assigned. If any account requiring a unique custom account uses an account that any other service utilizes (regardless of service status), this is a finding.</check-content></check></Rule></Group><Group id="V-41202"><title>SRG-APP-000062-DB-000009</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53669r4_rule" severity="medium" weight="10.0"><version>SQL2-00-008800</version><title>SQL Server must enforce separation of duties through assigned information access authorizations.</title><description>&lt;VulnDiscussion&gt;Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action.
 
@@ -2172,7 +2176,7 @@ REVOKE &lt;'server permission name'&gt; TO &lt;'account name'&gt; CASCADE
 
 Remove server role permission from the user-defined server role by running the following script:
 USE master
-REVOKE &lt;'server role name'&gt; TO [&lt;'server role name'&gt;]</fixtext><fix id="F-46594r2_fix" /><check system="C-47792r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check for direct user assignment to server permissions by running the following script:
+REVOKE &lt;'server role name'&gt; TO [&lt;'server role name'&gt;]</fixtext><fix id="F-46594r2_fix" /><check system="C-47792r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check for direct user assignment to server permissions by running the following script:
 /**********************************************************************************
  LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT
   SYSTEM ADMINISTRATOR accounts.  DO NOT LIST ROLES.
@@ -2273,10 +2277,10 @@ The DBMS must ensure the recipient of server permissions possesses only the acce
 Correct each unapproved GRANT_WITH_GRANT_OPTION with REVOKE and GRANT statements of the form (replacing "ALTER ANY DATABASE" with the actual server permission at issue):
 
 REVOKE ALTER ANY DATABASE FROM SampleLoginOrServerRole CASCADE;
-GRANT ALTER ANY DATABASE TO SampleServerRole;  -- Note, no WITH GRANT OPTION clause here.</fixtext><fix id="F-46596r4_fix" /><check system="C-47794r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check for rights propagation assignment to DBMS server permissions by running the following query:
+GRANT ALTER ANY DATABASE TO SampleServerRole;  -- Note, no WITH GRANT OPTION clause here.</fixtext><fix id="F-46596r4_fix" /><check system="C-47794r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check for rights propagation assignment to DBMS server permissions by running the following query:
 
 USE master;
-SELECT * 
+SELECT *
 FROM sys.server_permissions
 WHERE state_desc = 'GRANT_WITH_GRANT_OPTION';
 
@@ -2302,7 +2306,7 @@ ALTER SERVER ROLE [&lt;'server role name'&gt;] DROP MEMBER &lt;'user name'&gt;
 
 Add the user-defined role access to the user by running the following script:
 USE master
-ALTER SERVER ROLE [&lt;'server role name'&gt;] ADD  MEMBER &lt;'user name'&gt;</fixtext><fix id="F-46597r2_fix" /><check system="C-47795r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check for direct user assignment to server permissions by running the following script:
+ALTER SERVER ROLE [&lt;'server role name'&gt;] ADD  MEMBER &lt;'user name'&gt;</fixtext><fix id="F-46597r2_fix" /><check system="C-47795r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check for direct user assignment to server permissions by running the following script:
 /**********************************************************************************
  LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT
   SYSTEM ADMINISTRATOR accounts.  DO NOT LIST ROLES.
@@ -2403,20 +2407,20 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46598r1_fix">Remove the 'Unsafe assembly' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Unsafe assembly TO &lt;'role name'&gt;</fixtext><fix id="F-46598r1_fix" /><check system="C-47796r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Unsafe assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Unsafe assembly TO &lt;'role name'&gt;</fixtext><fix id="F-46598r1_fix" /><check system="C-47796r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Unsafe assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Unsafe assembly' 
+       what.permission_name = 'Unsafe assembly'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
@@ -2426,54 +2430,54 @@ GO
 If any role has 'Grant', 'With Grant' or 'Deny' privileges to the 'Unsafe assembly' permission and the role is not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41207"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53674r4_rule" severity="medium" weight="10.0"><version>SQL2-00-008300</version><title>SQL Server must not grant users direct access to the Alter any endpoint permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -2490,20 +2494,20 @@ USE master
 
 REVOKE ALTER ANY ENDPOINT TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46599r1_fix" /><check system="C-47798r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any endpoint' by running the following query:
+GO</fixtext><fix id="F-46599r1_fix" /><check system="C-47798r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any endpoint' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any endpoint' 
+       what.permission_name = 'Alter any endpoint'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -2514,55 +2518,55 @@ GO
 If any user accounts have direct access to the 'Alter any endpoint' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41208"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53675r4_rule" severity="medium" weight="10.0"><version>SQL2-00-008200</version><title>SQL Server must not grant users direct access to the Alter any database permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -2579,20 +2583,20 @@ USE master
 
 REVOKE ALTER ANY DATABASE TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46600r1_fix" /><check system="C-47799r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any database' by running the following query:
+GO</fixtext><fix id="F-46600r1_fix" /><check system="C-47799r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any database' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any database' 
+       what.permission_name = 'Alter any database'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -2603,55 +2607,55 @@ GO
 If any user accounts have direct access to the 'Alter any database' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41209"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53677r4_rule" severity="medium" weight="10.0"><version>SQL2-00-008100</version><title>SQL Server must not grant users direct access to the Alter Any Credential permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -2668,20 +2672,20 @@ USE master
 
 REVOKE ALTER ANY CREDENTIAL TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46602r1_fix" /><check system="C-47800r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any credential' by running the following query:
+GO</fixtext><fix id="F-46602r1_fix" /><check system="C-47800r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any credential' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any credential' 
+       what.permission_name = 'Alter any credential'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -2692,55 +2696,55 @@ GO
 If any user accounts have direct access to the 'Alter any credential' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41246"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53727r4_rule" severity="medium" weight="10.0"><version>SQL2-00-008000</version><title>SQL Server must not grant users direct access to the Alter any connection permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -2757,20 +2761,20 @@ USE master
 
 REVOKE ALTER ANY CONNECTION TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46636r1_fix" /><check system="C-47813r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any connection' by running the following query:
+GO</fixtext><fix id="F-46636r1_fix" /><check system="C-47813r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any connection' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any connection' 
+       what.permission_name = 'Alter any connection'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -2781,57 +2785,57 @@ GO
 If any user accounts have direct access to the 'Alter any connection' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</check-content></check></Rule></Group><Group id="V-41247"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53728r5_rule" severity="medium" weight="10.0"><version>SQL2-00-007900</version><title>SQL Server must not grant users direct access control to the Alter Any Availability Group permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. 
+GO</check-content></check></Rule></Group><Group id="V-41247"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53728r5_rule" severity="medium" weight="10.0"><version>SQL2-00-007900</version><title>SQL Server must not grant users direct access control to the Alter Any Availability Group permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
 
@@ -2859,20 +2863,20 @@ GO
 -- For each user identified in the Check who needs this permission:
 USE master;
 ALTER SERVER ROLE &lt;role name&gt; ADD MEMBER &lt;login name&gt;;
-GO</fixtext><fix id="F-46637r3_fix" /><check system="C-47814r10_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any availability group' by running the following query:
+GO</fixtext><fix id="F-46637r3_fix" /><check system="C-47814r10_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any availability group' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any availability group' 
+       what.permission_name = 'Alter any availability group'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -2883,55 +2887,55 @@ GO
 If any user accounts have direct access to the 'Alter any availability group' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41248"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53729r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007800</version><title>SQL Server must not grant users direct access to the Alter server state permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -2948,16 +2952,16 @@ USE master
 
 REVOKE ALTER SERVER STATE TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46638r1_fix" /><check system="C-47815r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter server state' by running the following query:
+GO</fixtext><fix id="F-46638r1_fix" /><check system="C-47815r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter server state' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -2972,55 +2976,55 @@ GO
 If any user accounts have direct access to the 'Alter server state' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41250"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53732r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007600</version><title>SQL Server must not grant users direct access to the Alter any event notification permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3037,16 +3041,16 @@ USE master
 
 REVOKE ALTER ANY EVENT NOTIFICATION TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46641r1_fix" /><check system="C-47818r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any event notification' by running the following query:
+GO</fixtext><fix id="F-46641r1_fix" /><check system="C-47818r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any event notification' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -3061,55 +3065,55 @@ GO
 If any user accounts have direct access to the 'Alter any event notification' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41251"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53733r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007500</version><title>SQL Server must enforce access control policies to restrict the View any database permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3121,77 +3125,77 @@ Additionally, the permission must not be denied to a role, because that could di
 
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46642r3_fix">Remove the "View any database" permission access from the role that is not authorized by executing the following query:
 
-REVOKE View any database TO &lt;'role name'&gt;</fixtext><fix id="F-46642r3_fix" /><check system="C-47819r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'View any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE View any database TO &lt;'role name'&gt;</fixtext><fix id="F-46642r3_fix" /><check system="C-47819r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'View any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'View any database' 
+       what.permission_name = 'View any database'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41252"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53734r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007400</version><title>SQL Server must not grant users direct access to the Alter any server audit permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3208,20 +3212,20 @@ USE master
 
 REVOKE ALTER ANY SERVER AUDIT TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46643r1_fix" /><check system="C-47820r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any server audit' by running the following query:
+GO</fixtext><fix id="F-46643r1_fix" /><check system="C-47820r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any server audit' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any server audit' 
+       what.permission_name = 'Alter any server audit'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -3232,55 +3236,55 @@ GO
 If any user accounts have direct access to the 'Alter any server audit' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41253"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53735r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007300</version><title>SQL Server must enforce access control policies to restrict the Shutdown permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3293,16 +3297,16 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46644r1_fix">Remove the' 'Shutdown' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Shutdown TO &lt;'role name'&gt;</fixtext><fix id="F-46644r1_fix" /><check system="C-47821r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the 'Shutdown' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Shutdown TO &lt;'role name'&gt;</fixtext><fix id="F-46644r1_fix" /><check system="C-47821r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the 'Shutdown' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -3311,59 +3315,59 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41254"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53736r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007200</version><title>SQL Server must enforce access control policies to restrict the External access assembly permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3376,77 +3380,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46645r1_fix">Remove the 'External access assembly' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE External access assembly TO &lt;'role name'&gt;</fixtext><fix id="F-46645r1_fix" /><check system="C-47822r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'External access assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE External access assembly TO &lt;'role name'&gt;</fixtext><fix id="F-46645r1_fix" /><check system="C-47822r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'External access assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'External access assembly' 
+       what.permission_name = 'External access assembly'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41255"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53737r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007100</version><title>SQL Server must enforce access control policies to restrict the Create trace event notification permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3459,16 +3463,16 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46646r1_fix">Remove the 'Create trace event notification' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Create trace event notification TO &lt;'role name'&gt;</fixtext><fix id="F-46646r1_fix" /><check system="C-47823r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create trace event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Create trace event notification TO &lt;'role name'&gt;</fixtext><fix id="F-46646r1_fix" /><check system="C-47823r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create trace event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -3477,59 +3481,59 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41256"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53738r4_rule" severity="medium" weight="10.0"><version>SQL2-00-007000</version><title>SQL Server must enforce access control policies to restrict the Create server role permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3542,16 +3546,16 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46647r1_fix">Remove the 'Create server role' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Create server role TO &lt;'role name'&gt;</fixtext><fix id="F-46647r1_fix" /><check system="C-47824r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Create server role TO &lt;'role name'&gt;</fixtext><fix id="F-46647r1_fix" /><check system="C-47824r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -3560,59 +3564,59 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41257"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53739r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006900</version><title>SQL Server must enforce access control policies to restrict the Create endpoint permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3625,79 +3629,79 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46648r1_fix">Remove the 'Create endpoint' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Create endpoint TO &lt;'role name'&gt;</fixtext><fix id="F-46648r1_fix" /><check system="C-47825r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
+REVOKE Create endpoint TO &lt;'role name'&gt;</fixtext><fix id="F-46648r1_fix" /><check system="C-47825r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
 
 Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create endpoint' 
+       what.permission_name = 'Create endpoint'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41258"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53740r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006800</version><title>SQL Server must enforce access control policies to restrict the Create DDL event notification permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3710,77 +3714,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46649r1_fix">Remove the 'Create DDL event notification' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Create DDL event notification TO &lt;'role name'&gt;</fixtext><fix id="F-46649r1_fix" /><check system="C-47826r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create DDL event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Create DDL event notification TO &lt;'role name'&gt;</fixtext><fix id="F-46649r1_fix" /><check system="C-47826r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create DDL event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create DDL event notification' 
+       what.permission_name = 'Create DDL event notification'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41259"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53741r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006700</version><title>SQL Server must enforce access control policies to restrict the Create availability group permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3793,77 +3797,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46650r1_fix">Remove the 'Create availability group' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Create availability group TO &lt;'role name'&gt;</fixtext><fix id="F-46650r1_fix" /><check system="C-47827r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Create availability group TO &lt;'role name'&gt;</fixtext><fix id="F-46650r1_fix" /><check system="C-47827r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create availability group' 
+       what.permission_name = 'Create availability group'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41260"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53742r3_rule" severity="medium" weight="10.0"><version>SQL2-00-006600</version><title>SQL Server must enforce access control policies to restrict the Alter any server audit permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3876,25 +3880,25 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46651r1_fix">Remove the 'Alter any server audit' permission access from the role that is not authorized  by executing the following query:
 
 
-REVOKE Alter any server audit TO &lt;'role name'&gt;</fixtext><fix id="F-46651r1_fix" /><check system="C-47828r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any server audit' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any server audit TO &lt;'role name'&gt;</fixtext><fix id="F-46651r1_fix" /><check system="C-47828r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any server audit' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any server audit' 
+       what.permission_name = 'Alter any server audit'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</check-content></check></Rule></Group><Group id="V-41261"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53743r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006500</version><title>SQL Server must enforce access control policies to restrict the View any definition permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3907,77 +3911,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46652r1_fix">Remove the 'View any definition' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE View any definition TO &lt;'role name'&gt;</fixtext><fix id="F-46652r1_fix" /><check system="C-47829r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'View any definition' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE View any definition TO &lt;'role name'&gt;</fixtext><fix id="F-46652r1_fix" /><check system="C-47829r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'View any definition' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'View any definition' 
+       what.permission_name = 'View any definition'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41262"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53744r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006400</version><title>SQL Server must not grant users direct access to the Authenticate server permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -3991,16 +3995,16 @@ Note that this does not apply to logins with names of the form '##MS...##'.  The
 
 USE master;
 REVOKE AUTHENTICATE SERVER FROM &lt;account name&gt;;
-GO</fixtext><fix id="F-46653r2_fix" /><check system="C-47830r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Authenticate Server' by running the following query:
+GO</fixtext><fix id="F-46653r2_fix" /><check system="C-47830r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Authenticate Server' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4015,55 +4019,55 @@ GO
 If any user accounts have direct access to the 'Authenticate Server' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41263"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53745r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006300</version><title>SQL Server must not grant users direct access to the Administer bulk operations permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4080,16 +4084,16 @@ USE master
 
 REVOKE ADMINISTER BULK OPERATIONS TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46654r1_fix" /><check system="C-47831r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Administer bulk operations' by running the following query:
+GO</fixtext><fix id="F-46654r1_fix" /><check system="C-47831r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Administer bulk operations' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4104,55 +4108,55 @@ GO
 If any user accounts have direct access to the 'Administer bulk operations' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41264"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53746r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006200</version><title>SQL Server must not grant users direct access to the Create endpoint permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4169,16 +4173,16 @@ USE master
 
 REVOKE CREATE ENDPOINT TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46655r1_fix" /><check system="C-47832r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create endpoint' by running the following query:
+GO</fixtext><fix id="F-46655r1_fix" /><check system="C-47832r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create endpoint' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4193,55 +4197,55 @@ GO
 If any user accounts have direct access to the 'Create endpoint' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41265"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53747r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006100</version><title>SQL Server must not grant users direct access to the Create DDL event notification permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4258,7 +4262,7 @@ USE master
 
 REVOKE CREATE DDL EVENT NOTIFICATION TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46656r1_fix" /><check system="C-47833r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create DDL Event Notification' by running the following query:
+GO</fixtext><fix id="F-46656r1_fix" /><check system="C-47833r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create DDL Event Notification' by running the following query:
 
 SELECT
 who.name AS [Principal Name],
@@ -4271,7 +4275,7 @@ sys.server_permissions what
 INNER JOIN sys.server_principals who
 ON who.principal_id = what.grantee_principal_id
 WHERE
-what.permission_name = 'Create DDL Event Notification' 
+what.permission_name = 'Create DDL Event Notification'
 AND who.name NOT LIKE '##MS%##'
 AND who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -4282,55 +4286,55 @@ GO
 If any user accounts have direct access to the 'Create DDL Event Notification' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41266"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53748r4_rule" severity="medium" weight="10.0"><version>SQL2-00-006000</version><title>SQL Server must not grant users direct access to the Create availability group permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4348,16 +4352,16 @@ USE master
 
 REVOKE CREATE AVAILABILITY GROUP TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46657r1_fix" /><check system="C-47834r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create availability group' by running the following query:
+GO</fixtext><fix id="F-46657r1_fix" /><check system="C-47834r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create availability group' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4372,55 +4376,55 @@ GO
 If any user accounts have direct access to the 'Create availability group' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41267"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53749r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005900</version><title>SQL Server must not grant users direct access to the Create any database permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4437,16 +4441,16 @@ USE master
 
 REVOKE CREATE ANY DATABASE TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46658r1_fix" /><check system="C-47835r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create any database' by running the following query:
+GO</fixtext><fix id="F-46658r1_fix" /><check system="C-47835r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create any database' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4461,55 +4465,55 @@ GO
 If any user accounts have direct access to the 'Create any database' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41268"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53750r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005800</version><title>SQL Server must not grant users direct access to the Control server permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4526,16 +4530,16 @@ USE master
 
 REVOKE CONTROL SERVER TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46659r1_fix" /><check system="C-47836r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Control server' by running the following query:
+GO</fixtext><fix id="F-46659r1_fix" /><check system="C-47836r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Control server' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4550,55 +4554,55 @@ GO
 If any user accounts have direct access to the 'Control server' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41269"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53751r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005700</version><title>SQL Server must enforce access control policies to restrict the Administer bulk operations permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4611,18 +4615,18 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46660r1_fix">Remove the 'Administer bulk operations' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Administer bulk operations TO &lt;'role name'&gt;</fixtext><fix id="F-46660r1_fix" /><check system="C-47837r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Administer bulk operations' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
+REVOKE Administer bulk operations TO &lt;'role name'&gt;</fixtext><fix id="F-46660r1_fix" /><check system="C-47837r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Administer bulk operations' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
 
 Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4631,59 +4635,59 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41270"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53752r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005600</version><title>SQL Server must enforce access control policies to restrict the Alter resources permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4696,77 +4700,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46661r1_fix">Remove the 'Alter resources' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter resources TO &lt;'role name'&gt;</fixtext><fix id="F-46661r1_fix" /><check system="C-47838r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter resources' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter resources TO &lt;'role name'&gt;</fixtext><fix id="F-46661r1_fix" /><check system="C-47838r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter resources' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter resources' 
+       what.permission_name = 'Alter resources'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41271"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53753r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005500</version><title>SQL Server must not grant users direct access to the Alter any linked server permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4783,16 +4787,16 @@ USE master
 
 REVOKE ALTER ANY LINKED SERVER TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46662r1_fix" /><check system="C-47839r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any linked server' by running the following query:
+GO</fixtext><fix id="F-46662r1_fix" /><check system="C-47839r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any linked server' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4807,55 +4811,55 @@ GO
 If any user accounts have direct access to the 'Alter any linked server' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41273"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53755r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005300</version><title>SQL Server must not grant users direct control to the Alter any event session permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4872,16 +4876,16 @@ USE master
 
 REVOKE ALTER ANY EVENT SESSION TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46664r1_fix" /><check system="C-47841r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any event session' by running the following query:
+GO</fixtext><fix id="F-46664r1_fix" /><check system="C-47841r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any event session' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4896,55 +4900,55 @@ GO
 If any user accounts have direct access to the 'Alter any event session' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41274"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53756r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005200</version><title>SQL Server must not grant users direct access to the Alter trace permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -4961,16 +4965,16 @@ USE master
 
 REVOKE ALTER TRACE TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46665r1_fix" /><check system="C-47842r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter trace' by running the following query:
+GO</fixtext><fix id="F-46665r1_fix" /><check system="C-47842r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter trace' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -4985,55 +4989,55 @@ GO
 If any user accounts have direct access to the 'Alter trace' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41275"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53757r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005100</version><title>SQL Server must not grant users direct access to the Alter Settings permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5050,16 +5054,16 @@ USE master
 
 REVOKE ALTER SETTINGS TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46666r1_fix" /><check system="C-47843r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter Settings' by running the following query:
+GO</fixtext><fix id="F-46666r1_fix" /><check system="C-47843r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter Settings' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -5074,55 +5078,55 @@ GO
 If any user accounts have direct access to the 'Alter Settings' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41276"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53758r4_rule" severity="medium" weight="10.0"><version>SQL2-00-005000</version><title>SQL Server must not grant users direct access to the Create trace event notification permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5139,20 +5143,20 @@ USE master
 
 REVOKE CREATE TRACE EVENT NOTIFICATION TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46667r1_fix" /><check system="C-47844r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create trace event notification' by running the following query:
+GO</fixtext><fix id="F-46667r1_fix" /><check system="C-47844r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create trace event notification' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create trace event notification' 
+       what.permission_name = 'Create trace event notification'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -5163,55 +5167,55 @@ GO
 If any user accounts have direct access to the 'Create trace event notification' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41277"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53759r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004900</version><title>SQL Server must not grant users direct access to the Alter resources permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5228,16 +5232,16 @@ USE master
 
 REVOKE ALTER RESOURCES TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46668r1_fix" /><check system="C-47845r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter resources' by running the following query:
+GO</fixtext><fix id="F-46668r1_fix" /><check system="C-47845r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter resources' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -5252,55 +5256,55 @@ GO
 If any user accounts have direct access to the 'Alter resources' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41278"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53760r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004800</version><title>SQL Server must not grant users direct access to the External access assembly permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5317,16 +5321,16 @@ USE master
 
 REVOKE EXTERNAL ACCESS ASSEMBLY TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46669r1_fix" /><check system="C-47846r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'External access assembly' by running the following query:
+GO</fixtext><fix id="F-46669r1_fix" /><check system="C-47846r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'External access assembly' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -5341,55 +5345,55 @@ GO
 If any user accounts have direct access to the 'External access assembly' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41279"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53761r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004700</version><title>SQL Server must not grant users direct access to the Alter any login permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5406,16 +5410,16 @@ USE master
 
 REVOKE ALTER ANY LOGIN TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46670r1_fix" /><check system="C-47847r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any login' by running the following query:
+GO</fixtext><fix id="F-46670r1_fix" /><check system="C-47847r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any login' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -5430,55 +5434,55 @@ GO
 If any user accounts have direct access to the 'Alter any login' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41280"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53762r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004600</version><title>SQL Server must enforce access control policies to restrict the Alter any availability group permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5491,77 +5495,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46671r1_fix">Remove the 'Alter any availability group' permission access from the role that is not authorized  by executing the following query:
 
 
-REVOKE Alter any availability group TO &lt;'role name'&gt;</fixtext><fix id="F-46671r1_fix" /><check system="C-47848r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any availability group TO &lt;'role name'&gt;</fixtext><fix id="F-46671r1_fix" /><check system="C-47848r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any availability group' 
+       what.permission_name = 'Alter any availability group'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41281"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53763r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004500</version><title>SQL Server must enforce access control policies to restrict the Alter any login permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5574,77 +5578,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46672r1_fix">Remove the 'Alter any login' permission access from the role that is not authorized  by executing the following query:
 
 
-REVOKE Alter any login TO &lt;'role name'&gt;</fixtext><fix id="F-46672r1_fix" /><check system="C-47849r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any login' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any login TO &lt;'role name'&gt;</fixtext><fix id="F-46672r1_fix" /><check system="C-47849r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any login' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any login' 
+       what.permission_name = 'Alter any login'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41283"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53765r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004300</version><title>SQL Server must enforce access control policies to restrict the Alter any linked server permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5657,77 +5661,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46674r1_fix">Remove the 'Alter any linked server' permission access from the role that is not authorized  by executing the following query:
 
 
-REVOKE Alter any linked server TO &lt;'role name'&gt;</fixtext><fix id="F-46674r1_fix" /><check system="C-47851r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any linked server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any linked server TO &lt;'role name'&gt;</fixtext><fix id="F-46674r1_fix" /><check system="C-47851r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any linked server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any linked server' 
+       what.permission_name = 'Alter any linked server'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41284"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53766r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004200</version><title>SQL Server must not grant users direct access control to the Shutdown permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5744,20 +5748,20 @@ USE master
 
 REVOKE SHUTDOWN TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46675r1_fix" /><check system="C-47852r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Shutdown' by running the following query:
+GO</fixtext><fix id="F-46675r1_fix" /><check system="C-47852r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Shutdown' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Shutdown' 
+       what.permission_name = 'Shutdown'
 AND who.name NOT LIKE '##MS%##'
 AND who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -5768,55 +5772,55 @@ GO
 If any user accounts have direct access to the 'Shutdown' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41285"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53767r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004100</version><title>SQL Server must enforce access control policies to restrict the View server state permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5829,77 +5833,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46676r1_fix">Remove the 'View server state' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE View server state TO &lt;'role name'&gt;</fixtext><fix id="F-46676r1_fix" /><check system="C-47853r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'View server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE View server state TO &lt;'role name'&gt;</fixtext><fix id="F-46676r1_fix" /><check system="C-47853r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'View server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'View server state' 
+       what.permission_name = 'View server state'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41286"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53768r4_rule" severity="medium" weight="10.0"><version>SQL2-00-004000</version><title>SQL Server must enforce access control policies to restrict the Alter trace permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5912,77 +5916,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46677r1_fix">Remove the 'Alter trace' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter trace TO &lt;'role name'&gt;</fixtext><fix id="F-46677r1_fix" /><check system="C-47854r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter trace' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter trace TO &lt;'role name'&gt;</fixtext><fix id="F-46677r1_fix" /><check system="C-47854r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter trace' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter trace' 
+       what.permission_name = 'Alter trace'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41287"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53769r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003900</version><title>SQL Server must not grant users direct access to the Unsafe assembly permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -5999,16 +6003,16 @@ USE master
 
 REVOKE UNSAFE ASSEMBLY TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46678r1_fix" /><check system="C-47855r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Unsafe assembly' by running the following query:
+GO</fixtext><fix id="F-46678r1_fix" /><check system="C-47855r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Unsafe assembly' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6023,55 +6027,55 @@ GO
 If any user accounts have direct access to the 'Unsafe assembly' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41288"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53770r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003800</version><title>SQL Server must enforce access control policies to restrict the Control server permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6084,77 +6088,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46679r1_fix">Remove the 'Control server' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Control server TO &lt;'role name'&gt;</fixtext><fix id="F-46679r1_fix" /><check system="C-47856r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Control server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Control server TO &lt;'role name'&gt;</fixtext><fix id="F-46679r1_fix" /><check system="C-47856r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Control server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Control server' 
+       what.permission_name = 'Control server'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41289"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53771r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003700</version><title>SQL Server must not grant users direct access to the Create server role permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6171,16 +6175,16 @@ USE master
 
 REVOKE CREATE SERVER ROLE TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46680r1_fix" /><check system="C-47857r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create server role' by running the following query:
+GO</fixtext><fix id="F-46680r1_fix" /><check system="C-47857r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Create server role' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6195,55 +6199,55 @@ GO
 If any user accounts have direct access to the 'Create server role' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41290"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53772r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003600</version><title>SQL Server must enforce access control policies to restrict the Alter any server role permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6256,16 +6260,16 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46681r1_fix">Remove the 'Alter any server role' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter any server role TO &lt;'role name'&gt;</fixtext><fix id="F-46681r1_fix" /><check system="C-47858r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any server role TO &lt;'role name'&gt;</fixtext><fix id="F-46681r1_fix" /><check system="C-47858r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6274,59 +6278,59 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41291"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53773r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003500</version><title>SQL Server must enforce access control policies to restrict the Alter Settings permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6339,77 +6343,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46682r1_fix">Remove the 'Alter Settings' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter Settings TO &lt;'role name'&gt;</fixtext><fix id="F-46682r1_fix" /><check system="C-47859r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter Settings' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter Settings TO &lt;'role name'&gt;</fixtext><fix id="F-46682r1_fix" /><check system="C-47859r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter Settings' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter Settings' 
+       what.permission_name = 'Alter Settings'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41292"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53774r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003400</version><title>SQL Server must enforce access control policies to restrict the Authenticate server permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6422,77 +6426,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46683r1_fix">Remove the 'Authenticate server' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Authenticate server TO &lt;'role name'&gt;</fixtext><fix id="F-46683r1_fix" /><check system="C-47860r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Authenticate server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Authenticate server TO &lt;'role name'&gt;</fixtext><fix id="F-46683r1_fix" /><check system="C-47860r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Authenticate server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Authenticate server' 
+       what.permission_name = 'Authenticate server'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41293"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53775r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003300</version><title>SQL Server must enforce access control policies to restrict the Create any database permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6505,77 +6509,77 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46684r1_fix">Remove the 'Create any database' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Create any database TO &lt;'role name'&gt;</fixtext><fix id="F-46684r1_fix" /><check system="C-47861r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Create any database TO &lt;'role name'&gt;</fixtext><fix id="F-46684r1_fix" /><check system="C-47861r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Create any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create any database' 
+       what.permission_name = 'Create any database'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41294"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53776r6_rule" severity="medium" weight="10.0"><version>SQL2-00-003200</version><title>SQL Server must not grant users direct access to the View server state permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6591,16 +6595,16 @@ Remove the 'View server state' permission access from an account that has direct
 
 USE master;
 REVOKE VIEW SERVER STATE TO &lt;'account name'&gt;;
-GO</fixtext><fix id="F-46685r3_fix" /><check system="C-47862r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'View server state' by running the following query:
+GO</fixtext><fix id="F-46685r3_fix" /><check system="C-47862r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'View server state' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6615,55 +6619,55 @@ GO
 If any user account has direct access to the 'View server state' permission, and the need for this has not been documented and approved, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41295"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53777r4_rule" severity="medium" weight="10.0"><version>SQL2-00-003100</version><title>SQL Server must not grant users direct access to the Alter any server role permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6680,16 +6684,16 @@ USE master
 
 REVOKE ALTER ANY SERVER ROLE TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46686r1_fix" /><check system="C-47863r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any server role' by running the following query:
+GO</fixtext><fix id="F-46686r1_fix" /><check system="C-47863r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'Alter any server role' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6704,55 +6708,55 @@ GO
 If any user accounts have direct access to the 'Alter any server role' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41296"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53778r5_rule" severity="medium" weight="10.0"><version>SQL2-00-003000</version><title>SQL Server must not grant users direct access to the View any definition permission.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6769,16 +6773,16 @@ USE master
 
 REVOKE VIEW ANY DEFINITION TO &lt;'account name'&gt;
 
-GO</fixtext><fix id="F-46687r1_fix" /><check system="C-47864r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'View any definition' by running the following query:
+GO</fixtext><fix id="F-46687r1_fix" /><check system="C-47864r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'View any definition' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6793,55 +6797,55 @@ GO
 If any user accounts have direct access to the 'View any definition' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
 GO</check-content></check></Rule></Group><Group id="V-41297"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53779r3_rule" severity="medium" weight="10.0"><version>SQL2-00-002900</version><title>SQL Server must enforce access control policies to restrict the Alter any connection permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6854,25 +6858,25 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46688r1_fix">Remove the 'Alter any connection' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter any connection  TO &lt;'role name'&gt;</fixtext><fix id="F-46688r1_fix" /><check system="C-47865r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any connection' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any connection  TO &lt;'role name'&gt;</fixtext><fix id="F-46688r1_fix" /><check system="C-47865r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any connection' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any connection' 
+       what.permission_name = 'Alter any connection'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</check-content></check></Rule></Group><Group id="V-41298"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53780r3_rule" severity="medium" weight="10.0"><version>SQL2-00-002800</version><title>SQL Server must enforce access control policies to restrict the Alter any credential permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6885,25 +6889,25 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46689r1_fix">Remove the 'Alter any credential' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter any credential TO &lt;'role name'&gt;</fixtext><fix id="F-46689r1_fix" /><check system="C-47866r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any credential' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any credential TO &lt;'role name'&gt;</fixtext><fix id="F-46689r1_fix" /><check system="C-47866r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any credential' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any credential' 
+       what.permission_name = 'Alter any credential'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</check-content></check></Rule></Group><Group id="V-41299"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53781r3_rule" severity="medium" weight="10.0"><version>SQL2-00-002700</version><title>SQL Server must enforce access control policies to restrict the Alter any database permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6916,25 +6920,25 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46690r1_fix">Remove the 'Alter any database' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter any database TO &lt;'role name'&gt;</fixtext><fix id="F-46690r1_fix" /><check system="C-47867r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any database TO &lt;'role name'&gt;</fixtext><fix id="F-46690r1_fix" /><check system="C-47867r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any database' 
+       what.permission_name = 'Alter any database'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</check-content></check></Rule></Group><Group id="V-41300"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53782r3_rule" severity="medium" weight="10.0"><version>SQL2-00-002600</version><title>SQL Server must enforce access control policies to restrict the Alter any endpoint permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6947,25 +6951,25 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46691r1_fix">Remove the 'Alter any endpoint' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter any endpoint TO &lt;'role name'&gt;</fixtext><fix id="F-46691r1_fix" /><check system="C-47868r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any endpoint TO &lt;'role name'&gt;</fixtext><fix id="F-46691r1_fix" /><check system="C-47868r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any endpoint' 
+       what.permission_name = 'Alter any endpoint'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</check-content></check></Rule></Group><Group id="V-41302"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53784r3_rule" severity="medium" weight="10.0"><version>SQL2-00-002400</version><title>SQL Server must enforce access control policies to restrict the Alter any event session permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -6978,25 +6982,25 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46693r1_fix">Remove the 'Alter any event session' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter any event session TO &lt;'role name'&gt;</fixtext><fix id="F-46693r1_fix" /><check system="C-47870r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any event session TO &lt;'role name'&gt;</fixtext><fix id="F-46693r1_fix" /><check system="C-47870r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any event session' 
+       what.permission_name = 'Alter any event session'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</check-content></check></Rule></Group><Group id="V-41303"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53785r3_rule" severity="medium" weight="10.0"><version>SQL2-00-002300</version><title>SQL Server must enforce access control policies to restrict Alter server state permissions to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
@@ -7009,27 +7013,27 @@ Additionally, the permission must not be denied to a role, because that could di
 The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-46694r2_fix">Remove the 'Alter server state' permission access from the role that is not authorized by executing the following query:
 
 
-REVOKE Alter server state TO &lt;'role name'&gt;</fixtext><fix id="F-46694r2_fix" /><check system="C-47871r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. 
+REVOKE Alter server state TO &lt;'role name'&gt;</fixtext><fix id="F-46694r2_fix" /><check system="C-47871r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
 
 Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter server state' 
+       what.permission_name = 'Alter server state'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</check-content></check></Rule></Group><Group id="V-41304"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53786r4_rule" severity="medium" weight="10.0"><version>SQL2-00-002200</version><title>SQL Server must enforce non-DAC policies over users and resources where the policy rule set for each policy specifies access control information (i.e., position, nationality, age, project, time of day).</title><description>&lt;VulnDiscussion&gt;Non-DAC controls are determined by policy makers and are managed centrally or by a central authority. These controls must not be changed at the discretion of ordinary application users. Data protection requirements may result in a non-DAC policy being specified as part of the application design. Non-DACs are employed at the application level to restrict and control access to application data, thereby providing increased information security for the organization.
 
@@ -7045,7 +7049,7 @@ REVOKE &lt;'server permission name'&gt; TO &lt;'account name'&gt; CASCADE
 
 Remove the user from user-defined role access by running the following script:
 USE master
-ALTER SERVER ROLE [&lt;'server role name'&gt;] DROP MEMBER &lt;'user name'&gt;</fixtext><fix id="F-46695r2_fix" /><check system="C-47873r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check for direct user assignment to server permissions by running the following script:
+ALTER SERVER ROLE [&lt;'server role name'&gt;] DROP MEMBER &lt;'user name'&gt;</fixtext><fix id="F-46695r2_fix" /><check system="C-47873r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check for direct user assignment to server permissions by running the following script:
 /**********************************************************************************
 LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT
 SYSTEM ADMINISTRATOR ACCOUNTS.  DO NOT LIST ROLES.
@@ -7145,22 +7149,22 @@ Notification of account creation is one method and best practice for mitigating
 
 To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001684</ident><fixtext fixref="F-46696r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46696r5_fix" /><check system="C-47874r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46696r5_fix" /><check system="C-47874r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -7168,34 +7172,34 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41306"><title>SRG-APP-000027-DB-000186</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53788r4_rule" severity="medium" weight="10.0"><version>SQL2-00-001900</version><title>SQL Server must automatically audit account modification.</title><description>&lt;VulnDiscussion&gt;Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41306"><title>SRG-APP-000027-DB-000186</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53788r4_rule" severity="medium" weight="10.0"><version>SQL2-00-001900</version><title>SQL Server must automatically audit account modification.</title><description>&lt;VulnDiscussion&gt;Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account.
 
 Auditing of account modification is one method and best practice for mitigating this risk. A comprehensive application account management process ensures an audit trail automatically documents the modification of application user accounts and, as required, notifies administrators, application owners, and/or appropriate individuals. Applications must provide this capability directly, leverage complimentary technology providing this capability, or a combination thereof.
 
-Automated account-auditing processes greatly reduce the risk that accounts will be surreptitiously modified, and provides logging that can be used for forensic purposes.  
+Automated account-auditing processes greatly reduce the risk that accounts will be surreptitiously modified, and provides logging that can be used for forensic purposes.
 
 To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms meeting or exceeding access control policy requirements.  Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001403</ident><fixtext fixref="F-46697r5_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46697r5_fix" /><check system="C-47875r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46697r5_fix" /><check system="C-47875r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -7203,9 +7207,9 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41307"><title>SRG-APP-000019-DB-000197</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53789r4_rule" severity="medium" weight="10.0"><version>SQL2-00-001600</version><title>SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited.</title><description>&lt;VulnDiscussion&gt;Remote access is any access to an organizational information system by a user (or an information system) communicating through an external, non-organization-controlled network (e.g., the Internet). Examples of remote access methods include dial-up, broadband, and wireless.
 
@@ -7214,22 +7218,22 @@ Remote network and system access is accomplished by leveraging common communicat
 Numerous best practices are employed to protect remote connections, such as utilizing encryption to protect data sessions and firewalls to restrict and control network connectivity. In addition to these protections, auditing must also be utilized in order to track system activity, assist in diagnosing system issues, and provide evidence needed for forensic investigations post security incident.
 &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002186</ident><fixtext fixref="F-46698r7_fix">Create a trace that meets all auditing requirements.
 
-The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46698r7_fix" /><check system="C-47876r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Check to see that all required events are being audited.
+The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.</fixtext><fix id="F-46698r7_fix" /><check system="C-47876r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -7237,9 +7241,9 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</check-content></check></Rule></Group><Group id="V-41311"><title>SRG-APP-000001-DB-000031</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53793r4_rule" severity="medium" weight="10.0"><version>SQL2-00-000100</version><title>The number of concurrent SQL Server sessions for each system account must be limited.</title><description>&lt;VulnDiscussion&gt;A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks. For example, boundary protection devices can filter certain types of packets to protect devices on an organization’s internal network from being directly affected by DoS attacks.
 
@@ -7249,24 +7253,24 @@ When determining the appropriate values for this limit, take the characteristics
 
 Architectural note:  In SQL Server, a count of active sessions by user can be obtained from one of the dynamic management views.   For example:
 
-    SELECT original_login_name, count(*) 
-    FROM sys.dm_exec_sessions
-    WHERE is_user_process = 1
-    GROUP BY original_login_name;
+ SELECT original_login_name, count(*)
+ FROM sys.dm_exec_sessions
+ WHERE is_user_process = 1
+ GROUP BY original_login_name;
 
 However, for this to return an accurate count in a logon trigger, the user would have to have the View Server State privilege.  (Without this privilege, the trigger sees information only about the current session, so would always return a count of one.)  View Server State would give that user access to a wide swath of information about the server, violating SQL2-00-004100.  One way to avoid this exposure is to create a summary table, and a view of that table that restricts each user to seeing his/her own count, and establish a frequently-run background job to refresh the table (using the above query or similar).  The logon trigger then queries the view to obtain a count that is accurate enough for most purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-46702r5_fix">Establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation.
 
-Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users.</fixtext><fix id="F-46702r5_fix" /><check system="C-47880r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review the system documentation to determine whether any limits have been defined.  If not, this is a finding.
+Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users.</fixtext><fix id="F-46702r5_fix" /><check system="C-47880r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review the system documentation to determine whether any limits have been defined.  If not, this is a finding.
 
 If one limit has been defined but is not applied to all users, including privileged administrative accounts, this is a finding.
 
-If multiple limits have been defined, to accommodate different types of user, verify that together they cover all users.  If not, this is a finding. 
+If multiple limits have been defined, to accommodate different types of user, verify that together they cover all users.  If not, this is a finding.
 
 If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means.  If it does not work correctly, this is a finding.
 
 Otherwise, determine if a logon trigger exists:
 
-EITHER, in SQL Server Management Studio's Object Explorer tree: 
+EITHER, in SQL Server Management Studio's Object Explorer tree:
 Expand [SQL Server Instance] &gt;&gt; Security &gt;&gt; Server Objects &gt;&gt; Triggers
 
 OR run the query:
@@ -7274,25 +7278,25 @@ SELECT * FROM master.sys.server_triggers;
 
 If no triggers are listed, this is a finding.
 
-If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user.  If none are found, this is a finding. If they are present but disabled, this is a finding.  
+If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user.  If none are found, this is a finding. If they are present but disabled, this is a finding.
 
 Examine the trigger source code for logical correctness and for compliance with the documented limit(s).  If errors or variances exist, this is a finding.
 
 Verify that the system does execute the trigger(s) each time a user session is established.  If it does not operate correctly for all types of user, this is a finding.</check-content></check></Rule></Group><Group id="V-41419"><title>SRG-APP-000231-DB-000154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-53948r3_rule" severity="medium" weight="10.0"><version>SQL2-00-024500</version><title>The Service Master Key must be backed up, stored offline and off-site.</title><description>&lt;VulnDiscussion&gt;Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><fixtext fixref="F-46847r2_fix">Document and implement procedures to safely back up and store the Service Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key. Also, include provisions to store the key off-site.
 BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file'
-ENCRYPTION BY PASSWORD = 'password'</fixtext><fix id="F-46847r2_fix" /><check system="C-47954r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan.
+ENCRYPTION BY PASSWORD = 'password'</fixtext><fix id="F-46847r2_fix" /><check system="C-47954r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan.
 
 If the procedures or evidence do not exist, this is a finding.
 
 If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding.
 
-If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.</check-content></check></Rule></Group><Group id="V-43196"><title>SRG-APP-999999-DB-000209    </title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-55935r2_rule" severity="medium" weight="10.0"><version>SQL2-00-024600</version><title>Domain accounts used to manage a SQL Server platform must be different from those used to manage other platforms.</title><description>&lt;VulnDiscussion&gt;Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-48769r1_fix">Set up and use separate domain accounts to manage the SQL Server platform.  These accounts must be different from those used to manage other platforms.</fixtext><fix id="F-48769r1_fix" /><check system="C-49206r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Determine the accounts being used to manage the SQL Server operating system.  Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding.
+If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.</check-content></check></Rule></Group><Group id="V-43196"><title>SRG-APP-999999-DB-000209    </title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-55935r2_rule" severity="medium" weight="10.0"><version>SQL2-00-024600</version><title>Domain accounts used to manage a SQL Server platform must be different from those used to manage other platforms.</title><description>&lt;VulnDiscussion&gt;Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-48769r1_fix">Set up and use separate domain accounts to manage the SQL Server platform.  These accounts must be different from those used to manage other platforms.</fixtext><fix id="F-48769r1_fix" /><check system="C-49206r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Determine the accounts being used to manage the SQL Server operating system.  Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding.
 Note: If, because of the application configuration, there are multiple instances of SQL that would share a given exploit, a single account would be allowed to be used for the group and would not be considered a finding.
 </check-content></check></Rule></Group><Group id="V-53877"><title>SRG-APP-000196-DB-000301</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-68097r2_rule" severity="medium" weight="10.0"><version>SQL2-00-019601</version><title>SQL Server databases in the unclassified environment, containing sensitive information, must be encrypted using approved cryptography.</title><description>&lt;VulnDiscussion&gt;Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data.
 
 Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
 
-Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002450</ident><fixtext fixref="F-58707r1_fix">Configure SQL Server to encrypt sensitive data stored in each database. Use only NIST-certified cryptography to provide encryption.</fixtext><fix id="F-58707r1_fix" /><check system="C-54717r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If the system exists in the Classified environment, this is NA.
+Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002450</ident><fixtext fixref="F-58707r1_fix">Configure SQL Server to encrypt sensitive data stored in each database. Use only NIST-certified cryptography to provide encryption.</fixtext><fix id="F-58707r1_fix" /><check system="C-54717r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If the system exists in the Classified environment, this is NA.
 
 For each database under the SQL Server instance, review the system documentation to determine whether the database holds sensitive information. If it does not, this is not a finding.
 
@@ -7328,7 +7332,7 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 
 Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.
 
-Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents.</fixtext><fix id="F-59715r9_fix" /><check system="C-55479r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server default data directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location:
+Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents.</fixtext><fix id="F-59715r9_fix" /><check system="C-55479r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server default data directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location:
 HKEY_LOCAL_MACHINE
 &gt;&gt; SOFTWARE
 &gt;&gt; Microsoft
@@ -7384,10 +7388,10 @@ Note 3: In the interest of separation of responsibilities with least privilege,
 Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents.  This is not a finding.</check-content></check></Rule></Group><Group id="V-54879"><title>SRG-APP-000133-DB-000207</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-69125r3_rule" severity="medium" weight="10.0"><version>SQL2-00-025200</version><title>The OS must limit privileges to the SQL Server data directories and their subordinate directories and files.</title><description>&lt;VulnDiscussion&gt;Database files must be protected from unauthorized access.  Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-59741r9_fix">Navigate to the identified folder location(s).  Right-click the folder, click Properties.  On the Security tab, modify the security permissions so that files and folders have at most the permissions listed below. Right-click each folder under the identified folder(s), click Properties. On the Security tab, modify the security permissions so that at most the following permissions are present.
 CREATOR OWNER (Full Control)
 System (Full control)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read &amp; Execute) [Notes 1, 2]
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
-SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]  
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
+SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]
 System Administrators (Full Control)  [Note 3]
 
 
@@ -7414,13 +7418,13 @@ Note 2:  Tips for adding a service SID/virtual account to a folder's permission
 9) Permission like a normal user from here
 
 
-Note 3:  In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.</fixtext><fix id="F-59741r9_fix" /><check system="C-55505r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement:
-SELECT DISTINCT 
-LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 )) 
+Note 3:  In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.</fixtext><fix id="F-59741r9_fix" /><check system="C-55505r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement:
+SELECT DISTINCT
+LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 ))
 AS "Database Data File Paths",
 type_desc
 FROM sys.master_files
-WHERE database_id &gt; 4 
+WHERE database_id &gt; 4
 AND type = 0
 
 The query result is a list of file systems locations used for databases other than the system databases.  Navigate to each of those folder locations using a command prompt or Windows Explorer.  The following instructions assume that Windows Explorer is used.
@@ -7429,17 +7433,17 @@ The query result is a list of file systems locations used for databases other th
 Verify that the identified folders and their contents have only authorized privileges. Right-click each folder, click Properties. On the Security tab, verify that at most the following permissions are present:
 CREATOR OWNER (Full Control)
 System (Full control)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 System Administrators (Full Control)  [Note 3]
 SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read &amp; Execute) [Notes 1, 2]
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
-SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]  
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
+SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]
 If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.</check-content></check></Rule></Group><Group id="V-54881"><title>SRG-APP-000133-DB-000207</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-69127r4_rule" severity="medium" weight="10.0"><version>SQL2-00-025300</version><title>The OS must limit privileges to the SQL Server backup directories and files.</title><description>&lt;VulnDiscussion&gt;Backups must be protected from unauthorized deletion and modification.  They must also be protected from unauthorized use in database restoration.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-59743r7_fix">Navigate to the SQL Server backup directory location.  Right-click the folder, click Properties.  On the Security tab, modify the security permissions, so that files and folders have at most the permissions listed below. Right-click each folder under the SQL Server backup folder, click Properties. On the Security tab, modify the security permissions, so that at most the following permissions are present.
 CREATOR OWNER (Full Control)
 System (Full control)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
-SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
+SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]
 System Administrators (Full Control)  [Note 3]
 SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read &amp; Execute) [Notes 1, 2]
 
@@ -7465,11 +7469,11 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 8) Click "OK"
 9) Permission like a normal user from here
 
-Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.</fixtext><fix id="F-59743r7_fix" /><check system="C-55507r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: 
-HKEY_LOCAL_MACHINE 
-&gt;&gt; SOFTWARE 
+Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.</fixtext><fix id="F-59743r7_fix" /><check system="C-55507r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location:
+HKEY_LOCAL_MACHINE
+&gt;&gt; SOFTWARE
 &gt;&gt; Microsoft
-&gt;&gt; Microsoft SQL Server 
+&gt;&gt; Microsoft SQL Server
 &gt;&gt; [INSTANCE NAME]
 &gt;&gt; MSSQLServer
 &gt;&gt; BackupDirectory
@@ -7483,9 +7487,9 @@ Navigate to each folder location using a command prompt or Windows Explorer.  Th
 Verify that backup files and folders have only authorized privileges. Right-click the backup folder, click Properties. On the Security tab, verify that at most the following permissions are present:
 CREATOR OWNER (Full Control)
 System (Full control)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
-SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
+SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]
 System Administrators (Full Control)  [Note 3]
 SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read &amp; Execute) [Notes 1, 2]
 If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.
@@ -7526,7 +7530,7 @@ Note that this does not apply to logins with names of the form '##MS...##'. Thes
 
 USE master
 REVOKE VIEW ANY DATABASE TO &lt;'account name'&gt;
-GO   </fixtext><fix id="F-60677r1_fix" /><check system="C-56373r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'View Any Database' by running the following query:
+GO   </fixtext><fix id="F-60677r1_fix" /><check system="C-56373r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of accounts that have direct access to the server-level permission 'View Any Database' by running the following query:
 
 SELECT
 who.name AS [Principal Name],
@@ -7539,7 +7543,7 @@ sys.server_permissions what
 INNER JOIN sys.server_principals who
 ON who.principal_id = what.grantee_principal_id
 WHERE
-what.permission_name = 'View Any Database' 
+what.permission_name = 'View Any Database'
 AND who.name NOT LIKE '##MS%##'
 AND who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -7600,7 +7604,7 @@ ORDER BY
       what.permission_name,
       who.name
 ;
-GO</check-content></check></Rule></Group><Group id="V-59857"><title>SRG-APP-000063-DB-000018</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-74287r1_rule" severity="medium" weight="10.0"><version>SQL2-00-009710</version><title>Owners of privileged accounts must use non-privileged accounts for non-administrative activities.</title><description>&lt;VulnDiscussion&gt;Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-65267r1_fix">Require that DBAs and other privileged users use non-privileged accounts for non-administrative activities.</fixtext><fix id="F-65267r1_fix" /><check system="C-60603r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Review procedures and practices.  If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding.  If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding.</check-content></check></Rule></Group><Group id="V-59915"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-74345r1_rule" severity="medium" weight="10.0"><version>SQL2-00-002500</version><title>SQL Server must enforce access control policies to restrict the Alter any event notification permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
+GO</check-content></check></Rule></Group><Group id="V-59857"><title>SRG-APP-000063-DB-000018</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-74287r1_rule" severity="medium" weight="10.0"><version>SQL2-00-009710</version><title>Owners of privileged accounts must use non-privileged accounts for non-administrative activities.</title><description>&lt;VulnDiscussion&gt;Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-65267r1_fix">Require that DBAs and other privileged users use non-privileged accounts for non-administrative activities.</fixtext><fix id="F-65267r1_fix" /><check system="C-60603r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Review procedures and practices.  If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding.  If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding.</check-content></check></Rule></Group><Group id="V-59915"><title>SRG-APP-000035-DB-000007</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-74345r1_rule" severity="medium" weight="10.0"><version>SQL2-00-002500</version><title>SQL Server must enforce access control policies to restrict the Alter any event notification permission to only authorized roles.</title><description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
 
@@ -7610,7 +7614,7 @@ Additionally, the permission must not be denied to a role, because that could di
 
 The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-003014</ident><fixtext fixref="F-65331r1_fix">Remove the 'Alter any event notification' permission access from the role that is not authorized by executing the following query:
 
-REVOKE Alter any event notification TO &lt;'role name'&gt;</fixtext><fix id="F-65331r1_fix" /><check system="C-60611r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
+REVOKE Alter any event notification TO &lt;'role name'&gt;</fixtext><fix id="F-65331r1_fix" /><check system="C-60611r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
 SELECT
 who.name AS [Principal Name],
@@ -7638,7 +7642,7 @@ Ensure that files and folders that are part of, or related to, the SQL Server 20
 Type: All
 Principal: Everyone
 Access: Modify
-Applies to: This Folder, subfolder, and files [where applicable]</fixtext><fix id="F-75357r1_fix" /><check system="C-69611r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location:
+Applies to: This Folder, subfolder, and files [where applicable]</fixtext><fix id="F-75357r1_fix" /><check system="C-69611r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location:
 HKEY_LOCAL_MACHINE
 &gt;&gt; SOFTWARE
 &gt;&gt; Microsoft
@@ -7649,7 +7653,7 @@ HKEY_LOCAL_MACHINE
 
 Determine the location of separate but related softare, such as audit file management tools.
 
-Verify that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, verify 
+Verify that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, verify
 that the following is set up on at least one audit:
 Type: All
 Principal: Everyone
@@ -7662,7 +7666,7 @@ This convenience also presents the possibility of unauthorized individuals gaini
 
 This requirement is not intended to prohibit use of the Browser service in any circumstances; rather, it calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SQL Server Installation 2012</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SQL Server Installation 2012</dc:subject><dc:identifier>2561</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-77155r2_fix">If SQL Server Browser is needed, document the justification and obtain the appropriate approvals.
 
-Where SQL Server Browser is judged unnecessary, in the Services tool, double-click on "SQL Server Browser" to open its "Properties" dialog.  Set Startup Type to "Disabled".  If Service Status is "Running", click on "Stop".  Click on "OK".</fixtext><fix id="F-77155r2_fix" /><check system="C-71267r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>If the need for the SQL Server Browser service is documented, with appropriate approval, this is not a finding.
+Where SQL Server Browser is judged unnecessary, in the Services tool, double-click on "SQL Server Browser" to open its "Properties" dialog.  Set Startup Type to "Disabled".  If Service Status is "Running", click on "Stop".  Click on "OK".</fixtext><fix id="F-77155r2_fix" /><check system="C-71267r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>If the need for the SQL Server Browser service is documented, with appropriate approval, this is not a finding.
 
 Open the Services tool.
 
@@ -7688,15 +7692,15 @@ To enforce this in SQL Server, configure each DBMS-managed login to inherit the
 In SQL Server Management Studio Object Explorer, navigate to &lt;SQL Server instance name&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; &lt;login name&gt;.  Right-click, select Properties.  Select the check box Enforce Password Policy.  Click OK.
 
 Alternatively, for each identified Login, run the statement:
-ALTER LOGIN &lt;login name&gt; CHECK_POLICY = ON;</fixtext><fix id="F-78881r1_fix" /><check system="C-72667r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Run the statement:
+ALTER LOGIN &lt;login name&gt; CHECK_POLICY = ON;</fixtext><fix id="F-78881r1_fix" /><check system="C-72667r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Run the statement:
 SELECT
     name
-FROM 
-    sys.sql_logins 
+FROM
+    sys.sql_logins
 WHERE
     type_desc = 'SQL_LOGIN'
     AND is_disabled = 0
-    AND is_policy_checked = 0 ; 
+    AND is_policy_checked = 0 ;
 
 If no account names are listed, this is not a finding.
 
@@ -7715,7 +7719,7 @@ To enforce this in SQL Server, configure each DBMS-managed login to inherit the
 In SQL Server Management Studio Object Explorer, navigate to &lt;SQL Server instance name&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; &lt;login name&gt;. Right-click, select Properties. Select the check box Enforce Password Expiration. Click OK.
 
 Alternatively, for each identified Login, run the statement:
-ALTER LOGIN &lt;login name&gt; CHECK_EXPIRATION = ON;</fixtext><fix id="F-78817r1_fix" /><check system="C-72669r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide.xml" /><check-content>Run the statement:
+ALTER LOGIN &lt;login name&gt; CHECK_EXPIRATION = ON;</fixtext><fix id="F-78817r1_fix" /><check system="C-72669r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_MS SQL Server Instance 2012.xml" /><check-content>Run the statement:
 SELECT
 name
 FROM
diff --git a/source/StigData/Archive/Vsphere/U_VMW_vSphere_6-5_ESXi_STIG_V1R4_Manual-xccdf.log b/source/StigData/Archive/Vsphere/U_VMW_vSphere_6-5_ESXi_STIG_V1R4_Manual-xccdf.log
new file mode 100644
index 000000000..e822876dd
--- /dev/null
+++ b/source/StigData/Archive/Vsphere/U_VMW_vSphere_6-5_ESXi_STIG_V1R4_Manual-xccdf.log
@@ -0,0 +1,2 @@
+V-94349::From the Host Client, select the ESXi host, right click and go to "Permissions". Verify the CIM account user role is limited to read only and CIM permissions.::""
+V-93953::If the Exception users list contains accounts that do not require special permissions, this is a finding.::""
diff --git a/source/StigData/Archive/Vsphere/U_VMW_vSphere_6-5_ESXi_STIG_V1R4_Manual-xccdf.xml b/source/StigData/Archive/Vsphere/U_VMW_vSphere_6-5_ESXi_STIG_V1R4_Manual-xccdf.xml
new file mode 100644
index 000000000..bb352a1d0
--- /dev/null
+++ b/source/StigData/Archive/Vsphere/U_VMW_vSphere_6-5_ESXi_STIG_V1R4_Manual-xccdf.xml
@@ -0,0 +1,957 @@
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="VMware_vSphere_6-5_ESXi_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-27">accepted</status><title>VMware vSphere 6.5 ESXi Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 4 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-100543" selected="true" /></Profile><Group id="V-93949"><title>SRG-OS-000027-VMM-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104035r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000001</version><title>The ESXi host must limit the number of concurrent sessions to ten for all accounts and/or account types by enabling lockdown mode.</title><description>&lt;VulnDiscussion&gt;Enabling lockdown mode disables direct access to an ESXi host requiring the host be managed remotely from vCenter Server. This is done to ensure the roles and access controls implemented in vCenter are always enforced and users cannot bypass them by logging into a host directly. By forcing all interaction to occur through vCenter Server, the risk of someone inadvertently attaining elevated privileges or performing tasks that are not properly audited is greatly reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-100197r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Click edit on "Lockdown Mode" and set to Enabled (Normal or Strict).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$level = "lockdownNormal" OR "lockdownStrict"
+$vmhost = Get-VMHost -Name &lt;hostname&gt; | Get-View
+$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
+$lockdown.ChangeLockdownMode($level)
+
+Note: In strict lockdown mode the DCUI service is stopped. If the connection to vCenter Server is lost and the vSphere Web Client is no longer available, the ESXi host becomes inaccessible.</fixtext><fix id="F-100197r1_fix" /><check system="C-93267r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Scroll down to "Lockdown Mode" and verify it is set to Enabled (Normal or Strict).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}
+
+If Lockdown Mode is disabled, this is a finding.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-93951"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104037r1_rule" severity="low" weight="10.0"><version>ESXI-65-000002</version><title>The ESXi host must verify the DCUI.Access list.</title><description>&lt;VulnDiscussion&gt;Lockdown mode disables direct host access requiring that admins manage hosts from vCenter Server.  However, if a host becomes isolated from vCenter Server, the admin is locked out and can no longer manage the host. If you are using normal lockdown mode, you can avoid becoming locked out of an ESXi host that is running in lockdown mode, by setting DCUI.Access to a list of highly trusted users who can override lockdown mode and access the DCUI. The DCUI is not running in strict lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100199r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Click Edit and select the DCUI.Access value and configure it to root.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name DCUI.Access | Set-AdvancedSetting -Value "root"</fixtext><fix id="F-100199r1_fix" /><check system="C-93269r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the DCUI.Access value and verify only the root user is listed.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.
+
+If the DCUI.Access is not restricted to root, this is a finding.
+
+Note: This list is only for local user accounts and should only contain the root user.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-93953"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104039r1_rule" severity="low" weight="10.0"><version>ESXI-65-000003</version><title>The ESXi host must verify the exception users list for lockdown mode.</title><description>&lt;VulnDiscussion&gt;In vSphere you can add users to the Exception Users list from the vSphere Web Client. These users do not lose their permissions when the host enters lockdown mode. Usually you may want to add service accounts such as a backup agent to the Exception Users list. Verify that the list of users who are exempted from losing permissions is legitimate and as needed per your environment. Users who do not require special permissions should not be exempted from lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100201r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under lockdown mode click Edit and remove unnecessary users to the exceptions list.</fixtext><fix id="F-100201r1_fix" /><check system="C-93271r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under lockdown mode review the exception users list.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following script:
+
+$vmhost = Get-VMHost | Get-View
+$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
+$lockdown.QueryLockdownExceptions()
+
+If the Exception users list contains accounts that do not require special permissions, this is a finding.
+
+Note - This list is not intended for system administrator accounts but for special circumstances such as a service account.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-93955"><title>SRG-OS-000032-VMM-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104041r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000004</version><title>Remote logging for ESXi hosts must be configured.</title><description>&lt;VulnDiscussion&gt;Remote logging to a central log host provides a secure, centralized store for ESXi logs. By gathering host log files onto a central host it can more easily monitor all hosts with a single tool. It can also do aggregate analysis and searching to look for such things as coordinated attacks on multiple hosts. Logging to a secure, centralized log server also helps prevent log tampering and also provides a long-term audit record.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000067</ident><fixtext fixref="F-100203r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Syslog.global.logHost value and configure it to a site specific syslog server.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost | Set-AdvancedSetting -Value "&lt;syslog server hostname&gt;"</fixtext><fix id="F-100203r1_fix" /><check system="C-93273r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Syslog.global.logHost value and verify it is set to a site specific syslog server hostname.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost
+
+If the Syslog.global.logHost setting is not set to a site specific syslog server, this is a finding.</check-content></check></Rule></Group><Group id="V-93957"><title>SRG-OS-000021-VMM-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104043r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000005</version><title>The ESXi host must enforce the limit of three consecutive invalid logon attempts by a user.</title><description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000044</ident><fixtext fixref="F-100205r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Security.AccountLockFailures value and configure it to 3.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures | Set-AdvancedSetting -Value 3</fixtext><fix id="F-100205r1_fix" /><check system="C-93275r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountLockFailures value and verify it is set to 3.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures and verify it is set to 3.
+
+If the Security.AccountLockFailures is set to a value other than 3, this is a finding.</check-content></check></Rule></Group><Group id="V-93959"><title>SRG-OS-000329-VMM-001180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104045r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000006</version><title>The ESXi host must enforce the unlock timeout of 15 minutes after a user account is locked out.</title><description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002238</ident><fixtext fixref="F-100207r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Security.AccountUnlockTime value and configure it to 900.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime | Set-AdvancedSetting -Value 900</fixtext><fix id="F-100207r1_fix" /><check system="C-93277r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountUnlockTime value and verify it is set to 900.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime and verify it is set to 900.
+
+If the Security.AccountUnlockTime is set to a value other than 900, this is a finding.</check-content></check></Rule></Group><Group id="V-93961"><title>SRG-OS-000023-VMM-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104047r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000007</version><title>The ESXi host must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</title><description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000048</ident><fixtext fixref="F-100209r1_fix">From a PowerCLI command prompt while connected to the ESXi host copy the following contents into a script(.ps1 file) and run to set the DCUI screen to display the DoD logon banner:
+
+&lt;script begin&gt;
+
+$value = @"
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{hostname} , {ip}{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{esxproduct} {esxversion}{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{memory} RAM{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:white}        {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By      {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  using this IS (which includes any device attached to this IS), you consent to the following conditions:                 {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited     {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law      {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          enforcement (LE), and counterintelligence (CI) investigations.                                                  {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       At any time, the USG may inspect and seize data stored on this IS.                                              {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       Communications using, or data stored on, this IS are not private, are subject to routine monitoring,            {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          interception, and search, and may be disclosed or used for any USG-authorized purpose.                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not     {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          for your personal benefit or privacy.                                                                           {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching    {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          or monitoring of the content of privileged communications, or work product, related to personal representation  {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work       {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          product are private and confidential. See User Agreement for details.                                           {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{align:left}{bgcolor:dark-grey}{color:white}  &lt;F2&gt; Accept Conditions and Customize System / View Logs{/align}{align:right}&lt;F12&gt; Accept Conditions and Shut Down/Restart  {bgcolor:black} {/color}{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+"@
+
+Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage | Set-AdvancedSetting -Value $value
+
+&lt;script end&gt;</fixtext><fix id="F-100209r1_fix" /><check system="C-93279r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Annotations.WelcomeMessage value and verify it contains the DoD logon banner to follow.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage
+
+Check for either of the following login banners based on the character limitations imposed by the system. An exact match of the text is required. If one of these banners is not displayed, this is a finding.
+
+You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+-At any time, the USG may inspect and seize data stored on this IS.
+
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests- -not for your personal benefit or privacy.
+
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
+
+OR
+
+I've read &amp; consent to terms in IS user agreem't.
+
+If the DCUI logon screen does not display the DoD logon banner, this is a finding.</check-content></check></Rule></Group><Group id="V-93963"><title>SRG-OS-000023-VMM-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104049r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000008</version><title>The ESXi host must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</title><description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000048</ident><fixtext fixref="F-100211r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.Etc.issue value and set it to the following.
+
+"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue | Set-AdvancedSetting -Value "&lt;insert logon banner&gt;"</fixtext><fix id="F-100211r1_fix" /><check system="C-93281r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.Etc.issue value and verify it is set to DoD logon banner below.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue
+
+If the Config.Etc.issue setting (/etc/issue file) does not contain the logon banner exactly as shown below this is a finding.
+
+"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."</check-content></check></Rule></Group><Group id="V-93965"><title>SRG-OS-000023-VMM-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104051r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000009</version><title>The ESXi host SSH daemon must be configured with the Department of Defense (DoD) login banner.</title><description>&lt;VulnDiscussion&gt;The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000048</ident><fixtext fixref="F-100213r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Banner /etc/issue</fixtext><fix id="F-100213r1_fix" /><check system="C-93283r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Banner" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Banner /etc/issue", this is a finding.</check-content></check></Rule></Group><Group id="V-93967"><title>SRG-OS-000033-VMM-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104053r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000010</version><title>The ESXi host SSH daemon must use DoD-approved encryption to protect the confidentiality of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Approved algorithms should impart some level of confidence in their implementation. Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
+
+Note: This does not imply FIPS 140-2 validation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-100215r1_fix">Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
+
+From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Ciphers aes128-ctr,aes192-ctr,aes256-ctr</fixtext><fix id="F-100215r1_fix" /><check system="C-93285r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command from an SSH session connected to the ESXi host, or from the ESXi shell:
+
+# grep -i "^Ciphers" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Ciphers aes128-ctr,aes192-ctr,aes256-ctr", this is a finding.</check-content></check></Rule></Group><Group id="V-93969"><title>SRG-OS-000033-VMM-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104055r1_rule" severity="high" weight="10.0"><version>ESXI-65-000011</version><title>The ESXi host SSH daemon must be configured to use only the SSHv2 protocol.</title><description>&lt;VulnDiscussion&gt;SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used. Only SSH protocol version 2 connections should be permitted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-100217r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config":
+
+Protocol 2</fixtext><fix id="F-100217r1_fix" /><check system="C-93287r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Protocol" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Protocol 2", this is a finding.</check-content></check></Rule></Group><Group id="V-93971"><title>SRG-OS-000107-VMM-000530</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104057r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000012</version><title>The ESXi host SSH daemon must ignore .rhosts files.</title><description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via ".rhosts" files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000767</ident><fixtext fixref="F-100219r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config":
+
+IgnoreRhosts yes</fixtext><fix id="F-100219r1_fix" /><check system="C-93289r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^IgnoreRhosts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "IgnoreRhosts yes", this is a finding.</check-content></check></Rule></Group><Group id="V-93973"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104059r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000013</version><title>The ESXi host SSH daemon must not allow host-based authentication.</title><description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptographic host-based authentication is more secure than ".rhosts" authentication, since hosts are cryptographically authenticated. However, it is not recommended that hosts unilaterally trust one another, even within an organization.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100221r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config":
+
+HostbasedAuthentication no</fixtext><fix id="F-100221r1_fix" /><check system="C-93291r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^HostbasedAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "HostbasedAuthentication no", this is a finding.</check-content></check></Rule></Group><Group id="V-93975"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104061r1_rule" severity="low" weight="10.0"><version>ESXI-65-000014</version><title>The ESXi host SSH daemon must not permit root logins.</title><description>&lt;VulnDiscussion&gt;Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100223r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config":
+
+PermitRootLogin no</fixtext><fix id="F-100223r1_fix" /><check system="C-93293r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitRootLogin" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitRootLogin no", this is a finding.</check-content></check></Rule></Group><Group id="V-93977"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104063r1_rule" severity="high" weight="10.0"><version>ESXI-65-000015</version><title>The ESXi host SSH daemon must not allow authentication using an empty password.</title><description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100225r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+PermitEmptyPasswords no</fixtext><fix id="F-100225r1_fix" /><check system="C-93295r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitEmptyPasswords" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitEmptyPasswords no", this is a finding.</check-content></check></Rule></Group><Group id="V-93979"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104065r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000016</version><title>The ESXi host SSH daemon must not permit user environment settings.</title><description>&lt;VulnDiscussion&gt;SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100227r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+PermitUserEnvironment no</fixtext><fix id="F-100227r1_fix" /><check system="C-93297r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitUserEnvironment" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitUserEnvironment no", this is a finding.</check-content></check></Rule></Group><Group id="V-93981"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104067r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000017</version><title>The ESXi host SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.</title><description>&lt;VulnDiscussion&gt;DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100229r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512</fixtext><fix id="F-100229r1_fix" /><check system="C-93299r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MACs" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512", this is a finding.</check-content></check></Rule></Group><Group id="V-93983"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104069r1_rule" severity="low" weight="10.0"><version>ESXI-65-000018</version><title>The ESXi host SSH daemon must not permit GSSAPI authentication.</title><description>&lt;VulnDiscussion&gt;GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100231r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+GSSAPIAuthentication no</fixtext><fix id="F-100231r1_fix" /><check system="C-93301r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GSSAPIAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GSSAPIAuthentication no", this is a finding.</check-content></check></Rule></Group><Group id="V-93985"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104071r1_rule" severity="low" weight="10.0"><version>ESXI-65-000019</version><title>The ESXi host SSH daemon must not permit Kerberos authentication.</title><description>&lt;VulnDiscussion&gt;Kerberos authentication for SSH is often implemented using GSSAPI.  If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation.  Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation.  To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100233r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+KerberosAuthentication no</fixtext><fix id="F-100233r1_fix" /><check system="C-93303r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^KerberosAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "KerberosAuthentication no", this is a finding.</check-content></check></Rule></Group><Group id="V-93987"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104073r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000020</version><title>The ESXi host SSH daemon must perform strict mode checking of home directory configuration files.</title><description>&lt;VulnDiscussion&gt;If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100235r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+StrictModes yes</fixtext><fix id="F-100235r1_fix" /><check system="C-93305r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^StrictModes" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "StrictModes yes", this is a finding.</check-content></check></Rule></Group><Group id="V-93989"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104075r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000021</version><title>The ESXi host SSH daemon must not allow compression or must only allow compression after successful authentication.</title><description>&lt;VulnDiscussion&gt;If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100237r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Compression no</fixtext><fix id="F-100237r1_fix" /><check system="C-93307r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Compression" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Compression no", this is a finding.</check-content></check></Rule></Group><Group id="V-93991"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104077r1_rule" severity="low" weight="10.0"><version>ESXI-65-000022</version><title>The ESXi host SSH daemon must be configured to not allow gateway ports.</title><description>&lt;VulnDiscussion&gt;SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs. Gateway ports allow remote forwarded ports to bind to non-loopback addresses on the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100239r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+GatewayPorts no</fixtext><fix id="F-100239r1_fix" /><check system="C-93309r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GatewayPorts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GatewayPorts no", this is a finding.</check-content></check></Rule></Group><Group id="V-93993"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104079r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000023</version><title>The ESXi host SSH daemon must be configured to not allow X11 forwarding.</title><description>&lt;VulnDiscussion&gt;X11 forwarding over SSH allows for the secure remote execution of X11-based applications. This feature can increase the attack surface of an SSH connection.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100241r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+X11Forwarding no</fixtext><fix id="F-100241r1_fix" /><check system="C-93311r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^X11Forwarding" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "X11Forwarding no", this is a finding.</check-content></check></Rule></Group><Group id="V-93995"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104081r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000024</version><title>The ESXi host SSH daemon must not accept environment variables from the client.</title><description>&lt;VulnDiscussion&gt;Environment variables can be used to change the behavior of remote sessions and should be limited. Locale environment variables that specify the language, character set, and other features modifying the operation of software to match the user's preferences.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100243r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+AcceptEnv</fixtext><fix id="F-100243r1_fix" /><check system="C-93313r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^AcceptEnv" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "AcceptEnv", this is a finding.</check-content></check></Rule></Group><Group id="V-93997"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104083r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000025</version><title>The ESXi host SSH daemon must not permit tunnels.</title><description>&lt;VulnDiscussion&gt;OpenSSH has the ability to create network tunnels (layer-2 and layer-3) over an SSH connection. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100245r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+PermitTunnel no</fixtext><fix id="F-100245r1_fix" /><check system="C-93315r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitTunnel" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitTunnel no", this is a finding.</check-content></check></Rule></Group><Group id="V-93999"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104085r1_rule" severity="low" weight="10.0"><version>ESXI-65-000026</version><title>The ESXi host SSH daemon must set a timeout count on idle sessions.</title><description>&lt;VulnDiscussion&gt;This ensures a user login will be terminated as soon as the "ClientAliveCountMax" is reached.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100247r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+ClientAliveCountMax 3</fixtext><fix id="F-100247r1_fix" /><check system="C-93317r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveCountMax" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveCountMax 3", this is a finding.</check-content></check></Rule></Group><Group id="V-94001"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104087r1_rule" severity="low" weight="10.0"><version>ESXI-65-000027</version><title>The ESXi hostSSH daemon must set a timeout interval on idle sessions.</title><description>&lt;VulnDiscussion&gt;Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100249r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+ClientAliveInterval 200</fixtext><fix id="F-100249r1_fix" /><check system="C-93319r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveInterval" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveInterval 200", this is a finding.</check-content></check></Rule></Group><Group id="V-94003"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104089r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000028</version><title>The ESXi host SSH daemon must limit connections to a single session.</title><description>&lt;VulnDiscussion&gt;The SSH protocol has the ability to provide multiple sessions over a single connection without reauthentication. A compromised client could use this feature to establish additional sessions to a system without consent or knowledge of the user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100251r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+MaxSessions 1</fixtext><fix id="F-100251r1_fix" /><check system="C-93321r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MaxSessions" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MaxSessions 1", this is a finding.</check-content></check></Rule></Group><Group id="V-94005"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104091r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000029</version><title>The ESXi host must remove keys from the SSH authorized_keys file.</title><description>&lt;VulnDiscussion&gt;ESXi hosts come with SSH which can be enabled to allow remote access without requiring user authentication.  To enable password free access copy the remote users public key into the "/etc/ssh/keys-root/authorized_keys" file on the ESXi host.  The presence of the remote user's public key in the "authorized_keys" file identifies the user as trusted, meaning the user is granted access to the host without providing a password.  If using Lockdown Mode and SSH is disabled then login with authorized keys will have the same restrictions as username/password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100253r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, zero or remove the /etc/ssh/keys-root/authorized_keys file:
+
+# &gt;/etc/ssh/keys-root/authorized_keys
+
+or
+
+# rm /etc/ssh/keys-root/authorized_keys</fixtext><fix id="F-100253r1_fix" /><check system="C-93323r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# ls -la /etc/ssh/keys-root/authorized_keys
+
+or
+
+# cat /etc/ssh/keys-root/authorized_keys
+
+If the authorized_keys file exists and is not empty, this is a finding.</check-content></check></Rule></Group><Group id="V-94007"><title>SRG-OS-000037-VMM-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104093r1_rule" severity="low" weight="10.0"><version>ESXI-65-000030</version><title>The ESXi host must produce audit records containing information to establish what type of events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-100255r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.log.level value and configure it to "info".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level | Set-AdvancedSetting -Value "info"</fixtext><fix id="F-100255r1_fix" /><check system="C-93325r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.HostAgent.log.level value and verify it is set to "info".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level
+
+If the Config.HostAgent.log.level setting is not set to info, this is a finding.
+
+Note: Verbose logging level is acceptable for troubleshooting purposes.</check-content></check></Rule></Group><Group id="V-94009"><title>SRG-OS-000069-VMM-000360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104095r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000031</version><title>The ESXi host  must enforce password complexity by requiring that at least one upper-case character be used.</title><description>&lt;VulnDiscussion&gt;To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000192</ident><fixtext fixref="F-100257r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Security.PasswordQualityControl value and configure it to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.PasswordQualityControl | Set-AdvancedSetting -Value "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15"</fixtext><fix id="F-100257r1_fix" /><check system="C-93327r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Security.PasswordQualityControl value and verify it is set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15"
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.PasswordQualityControl
+
+If the Security.PasswordQualityControl setting is not set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15", this is a finding.</check-content></check></Rule></Group><Group id="V-94011"><title>SRG-OS-000077-VMM-000440</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104097r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000032</version><title>The ESXi host must prohibit the reuse of passwords within five iterations.</title><description>&lt;VulnDiscussion&gt;If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000200</ident><fixtext fixref="F-100259r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in “/etc/pam.d/passwd”:
+
+password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512 remember=5</fixtext><fix id="F-100259r1_fix" /><check system="C-93329r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If the remember setting is not set or is not "remember=5", this is a finding.</check-content></check></Rule></Group><Group id="V-94013"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104099r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000033</version><title>The password hashes stored on the ESXi host must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.</title><description>&lt;VulnDiscussion&gt;Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100261r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in “/etc/pam.d/passwd”:
+
+password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512 remember=5</fixtext><fix id="F-100261r1_fix" /><check system="C-93331r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If sha512 is not listed, this is a finding.</check-content></check></Rule></Group><Group id="V-94015"><title>SRG-OS-000095-VMM-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104101r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000034</version><title>The ESXi host must disable the Managed Object Browser (MOB).</title><description>&lt;VulnDiscussion&gt;The Managed Object Browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host and enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK, but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access.  By default this is disabled for ESXi in version 6.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-100263r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.solo.enableMob value and configure it to false.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob | Set-AdvancedSetting -Value false</fixtext><fix id="F-100263r1_fix" /><check system="C-93333r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Config.HostAgent.plugins.solo.enableMob value and verify it is set to false.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob
+
+If the Config.HostAgent.plugins.solo.enableMob setting is not set to false, this is a finding.</check-content></check></Rule></Group><Group id="V-94017"><title>SRG-OS-000095-VMM-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104103r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000035</version><title>The ESXi host must be configured to disable non-essential capabilities by disabling SSH.</title><description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides temporary access to commands essential for server maintenance. Intended primarily for use in break-fix scenarios, the ESXi shell is well suited for checking and modifying configuration details, not always generally accessible, using the vSphere Client. The ESXi shell is accessible remotely using SSH by users with the Administrator role. Under normal operating conditions, SSH access to the host must be disabled as is the default.  As with the ESXi shell, SSH is also intended only for temporary use during break-fix scenarios. SSH must therefore be disabled under normal operating conditions and must only be enabled for diagnostics or troubleshooting. Remote access to the host must therefore be limited to the vSphere Client at all other times.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-100265r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit then select the SSH service and click the Stop button to stop the service. Use the pull-down menu to change the Startup policy to "Start and stop manually" and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"} | Set-VMHostService -Policy Off
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"} | Stop-VMHostService</fixtext><fix id="F-100265r1_fix" /><check system="C-93335r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit and view the "SSH" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"}
+
+If the ESXi SSH service is running, this is a finding.</check-content></check></Rule></Group><Group id="V-94019"><title>SRG-OS-000095-VMM-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104105r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000036</version><title>The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.</title><description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-100267r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit then select the ESXi Shell service and click the Stop button to stop the service. Use the pull-down menu to change the Startup policy to "Start and stop manually" and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Set-VMHostService -Policy Off
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Stop-VMHostService</fixtext><fix id="F-100267r1_fix" /><check system="C-93337r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under Services select Edit and view the "ESXi Shell" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"}
+
+If the ESXi Shell service is running, this is a finding.</check-content></check></Rule></Group><Group id="V-94021"><title>SRG-OS-000104-VMM-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104107r1_rule" severity="low" weight="10.0"><version>ESXI-65-000037</version><title>The ESXi host must use Active Directory for local user authentication.</title><description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-100269r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services. Click Join Domain and enter the AD domain to join, select the "Using credentials” radio button and enter the credentials of an account with permissions to join machines to AD (use UPN naming – user@domain) and then click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain -Domain "domain name" -User "username" -Password "password"</fixtext><fix id="F-100269r1_fix" /><check system="C-93339r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services.  Verify the Directory Services Type is set to Active Directory.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the Directory Services Type is not set to "Active Directory", this is a finding.</check-content></check></Rule></Group><Group id="V-94023"><title>SRG-OS-000104-VMM-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104109r2_rule" severity="medium" weight="10.0"><version>ESXI-65-000038</version><title>The ESXi host must use the vSphere Authentication Proxy to protect passwords when adding ESXi hosts to Active Directory.</title><description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-100271r1_fix">From the vSphere Web Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Security and Services &gt;&gt; Security Settings &gt;&gt; Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; Join Domain Method. Set the method used to join hosts to a domain to "Use vSphere Authentication Proxy to add the host to domain" and provide the IP address of the vSphere Authentication Proxy server.</fixtext><fix id="F-100271r1_fix" /><check system="C-93341r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Security and Services &gt;&gt; Security Settings &gt;&gt; Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; Join Domain Method. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if JoinADEnabled is True then JoinDomainMethod should be "FixedCAMConfigOption".
+
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-94025"><title>SRG-OS-000104-VMM-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104111r1_rule" severity="low" weight="10.0"><version>ESXI-65-000039</version><title>Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.</title><description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-100273r1_fix">From the vSphere Web Client select the ESXi Host and go to Configuration &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.hostsvc.esxAdminsGroup value and configure it to an Active Directory group other than "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup | Set-AdvancedSetting -Value &lt;AD Group&gt;</fixtext><fix id="F-100273r1_fix" /><check system="C-93343r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configuration &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.hostsvc.esxAdminsGroup value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" keyword is set to "ESX Admins", this is a finding.</check-content></check></Rule></Group><Group id="V-94027"><title>SRG-OS-000107-VMM-000530</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104113r1_rule" severity="low" weight="10.0"><version>ESXI-65-000040</version><title>The ESXi host must use multifactor authentication for local access to privileged accounts.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000767</ident><fixtext fixref="F-100275r1_fix">The following are pre-requisites to configuration smart card authentication for the ESXi DCUI:
+-Active Directory domain that supports smart card authentication, smart card readers, and smart cards.
+-ESXi joined to an Active Directory domain.
+-Trusted certificates for root and intermediary certificate authorities.
+
+From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services and click Edit and check "Enable Smart Card Authentication" checkbox, at the Certificates tab, click the green plus sign to import trusted certificate authority certificates and click OK.</fixtext><fix id="F-100275r1_fix" /><check system="C-93345r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services and view the Smart Card Authentication status. If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.</check-content></check></Rule></Group><Group id="V-94029"><title>SRG-OS-000163-VMM-000700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104115r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000041</version><title>The ESXi host must set a timeout to automatically disable idle sessions after 10 minutes.</title><description>&lt;VulnDiscussion&gt;If a user forgets to log out of their SSH session, the idle connection will remains open indefinitely, increasing the potential for someone to gain privileged access to the host.  The ESXiShellInteractiveTimeOut allows you to automatically terminate idle shell sessions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001133</ident><fixtext fixref="F-100277r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the UserVars.ESXiShellInteractiveTimeOut value and configure it to 600.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut | Set-AdvancedSetting -Value 600</fixtext><fix id="F-100277r1_fix" /><check system="C-93347r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellInteractiveTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut
+
+If the UserVars.ESXiShellInteractiveTimeOut setting is not set to 600, this is a finding.</check-content></check></Rule></Group><Group id="V-94031"><title>SRG-OS-000163-VMM-000700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104117r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000042</version><title>The ESXi host must terminate shell services after 10 minutes.</title><description>&lt;VulnDiscussion&gt;When the ESXi Shell or SSH services are enabled on a host they will run indefinitely.  To avoid having these services left running set the ESXiShellTimeOut.  The ESXiShellTimeOut defines a window of time after which the ESXi Shell and SSH services will automatically be terminated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001133</ident><fixtext fixref="F-100279r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the UserVars.ESXiShellTimeOut value and configure it to 600.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut | Set-AdvancedSetting -Value 600</fixtext><fix id="F-100279r1_fix" /><check system="C-93349r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut
+
+If the UserVars.ESXiShellTimeOut setting is not set to 600, this is a finding.</check-content></check></Rule></Group><Group id="V-94033"><title>SRG-OS-000163-VMM-000700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104119r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000043</version><title>The ESXi host must logout of the console UI after 10 minutes.</title><description>&lt;VulnDiscussion&gt;When the Direct console user interface (DCUI) is enabled and logged in it should be automatically logged out if left logged in to avoid unauthorized privilege gains.  The DcuiTimeOut defines a window of time after which the DCUI will be logged out.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001133</ident><fixtext fixref="F-100281r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the UserVars.DcuiTimeOut value and configure it to 600.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut | Set-AdvancedSetting -Value 600</fixtext><fix id="F-100281r1_fix" /><check system="C-93351r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.DcuiTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut
+
+If the UserVars.DcuiTimeOut setting is not set to 600, this is a finding.</check-content></check></Rule></Group><Group id="V-94035"><title>SRG-OS-000269-VMM-000950</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104121r1_rule" severity="low" weight="10.0"><version>ESXI-65-000044</version><title>The ESXi host must enable kernel core dumps.</title><description>&lt;VulnDiscussion&gt;In the event of a system failure, the system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001665</ident><fixtext fixref="F-100283r1_fix">From the vSphere Web Client select the ESXi Host and right click. Select the "Add Diagnostic Partition" option configure a core dump diagnostic partition.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run at least one of the following sets of commands:
+
+To configure a core dump partition:
+
+$esxcli = Get-EsxCli
+#View available partitions to configure
+$esxcli.system.coredump.partition.list()
+$esxcli.system.coredump.partition.set($null,"PartitionName",$null,$null)
+
+To configure a core dump collector:
+
+$esxcli = Get-EsxCli
+$esxcli.system.coredump.network.set($null,"vmkernel port to use",$null,"CollectorIP","CollectorPort")
+$esxcli.system.coredump.network.set($true)</fixtext><fix id="F-100283r1_fix" /><check system="C-93353r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and right click.  If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.system.coredump.partition.get()
+$esxcli.system.coredump.network.get()
+
+The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables.
+
+If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-94037"><title>SRG-OS-000341-VMM-001220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104123r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000045</version><title>The ESXi host must enable a persistent log location for all locally stored logs.</title><description>&lt;VulnDiscussion&gt;ESXi can be configured to store log files on an in-memory file system.  This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done only a single day's worth of logs are stored at any time. In addition log files will be reinitialized upon each reboot.  This presents a security risk as user activity logged on the host is only stored temporarily and will not persistent across reboots.  This can also complicate auditing and make it harder to monitor events and diagnose issues.  ESXi host logging should always be configured to a persistent datastore.
+
+Note: Scratch space is configured automatically during installation or first boot of an ESXi host, and does not usually need to be manually configured. ESXi Installable creates a 4 GB Fat16 partition on the target device during installation if there is sufficient space, and if the device is considered Local.  If ESXi is installed on an SD card or USB device a persistent log location may not be configured upon install as normal.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-100285r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Syslog.global.logDir value and set it to a known persistent location.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir | Set-AdvancedSetting -Value "New Log Location"</fixtext><fix id="F-100285r1_fix" /><check system="C-93355r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Syslog.global.logDir value and verify it is set to a persistent location.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir
+
+or
+
+$esxcli = Get-EsxCli
+$esxcli.system.syslog.config.get() | Select LocalLogOutput,LocalLogOutputIsPersistent
+
+If the Syslog.global.logDir or LocalLogOutput value is not on persistent storage, this is a finding.
+
+If the LocalLogOutputIsPersistent value is not true, this is a finding.</check-content></check></Rule></Group><Group id="V-94039"><title>SRG-OS-000355-VMM-001330</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104125r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000046</version><title>The ESXi host must configure NTP time synchronization.</title><description>&lt;VulnDiscussion&gt;To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001891</ident><fixtext fixref="F-100287r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to configure the NTP service to start and stop with the host and with authoritative DoD time sources.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+$NTPServers = "ntpserver1","ntpserver2"
+Get-VMHost | Add-VMHostNTPServer $NTPServers
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"} | Set-VMHostService -Policy On
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"} | Start-VMHostService</fixtext><fix id="F-100287r1_fix" /><check system="C-93357r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to verify the configured NTP servers and service startup policy.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostNTPServer
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"}
+
+If the NTP service is not configured with authoritative DoD time sources and the service is not configured to start and stop with the host and is running, this is a finding.</check-content></check></Rule></Group><Group id="V-94041"><title>SRG-OS-000366-VMM-001430</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104127r1_rule" severity="high" weight="10.0"><version>ESXI-65-000047</version><title>The ESXi Image Profile and VIB Acceptance Levels must be verified.</title><description>&lt;VulnDiscussion&gt;Verify the ESXi Image Profile to only allow signed VIBs.  An unsigned VIB represents untested code installed on an ESXi host.  The ESXi Image profile supports four acceptance levels:
+
+(1) VMwareCertified - VIBs created, tested and signed by VMware
+(2) VMwareAccepted - VIBs created by a VMware partner but tested and signed by VMware,
+(3) PartnerSupported - VIBs created, tested and signed by a certified VMware partner
+(4) CommunitySupported - VIBs that have not been tested by VMware or a VMware partner.
+
+Community Supported VIBs are not supported and do not have a digital signature.  To protect the security and integrity of your ESXi hosts do not allow unsigned (CommunitySupported) VIBs to be installed on your hosts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001749</ident><fixtext fixref="F-100289r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under "Host Image Profile Acceptance Level" click Edit… and use the pull-down selection, set the acceptance level to be VMwareCertified, VMwareAccepted, or PartnerSupported.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.software.acceptance.Set("PartnerSupported")
+
+Note: VMwareCertified or VMwareAccepted may be substituted for PartnerSupported, depending upon local requirements.</fixtext><fix id="F-100289r1_fix" /><check system="C-93359r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under "Host Image Profile Acceptance Level" view the acceptance level.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.software.acceptance.get()
+
+If the acceptance level is CommunitySupported, this is a finding.</check-content></check></Rule></Group><Group id="V-94043"><title>SRG-OS-000423-VMM-001700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104129r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000048</version><title>The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.</title><description>&lt;VulnDiscussion&gt;While encrypted vMotion is available now vMotion traffic should still be sequestered from other traffic to further protect it from attack. This network must be only be accessible to other ESXi hosts preventing outside access to the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-100291r1_fix">Configuration of the vMotion VMkernel will be unique to each environment. As an example, to modify the IP address and VLAN information to the correct network on a distributed switch do the following:
+
+From the vSphere Web Client go to Networking &gt;&gt; Select a distributed switch &gt;&gt; Select a port group &gt;&gt; Configure &gt;&gt; Settings &gt;&gt; Edit &gt;&gt; VLAN. Change the "VLAN Type" to "VLAN" and change the "VLAN ID" to a network allocated and dedicated to vMotion traffic exclusively.</fixtext><fix id="F-100291r1_fix" /><check system="C-93361r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>The vMotion VMKernel port group should in a dedicated VLAN that can be on a common standard or distributed virtual switch as long as the vMotion VLAN is not shared by any other function and it not routed to anything but ESXi hosts.  The check for this will be unique per environment.  From the vSphere Client select the ESXi host and go to Configuration &gt; Networking and review the VLAN associated with the vMotion VMkernel(s) and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If long distance or cross vCenter vMotion is used the vMotion network can be routable but must be accessible to only the intended ESXi hosts.
+
+If the vMotion port group is not on an isolated VLAN and/or is routable to systems other than ESXi hosts, this is a finding.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-94047"><title>SRG-OS-000423-VMM-001700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104133r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000050</version><title>The ESXi host must protect the confidentiality and integrity of transmitted information by protecting IP based management traffic.</title><description>&lt;VulnDiscussion&gt;Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI and NFS. This configuration might expose IP-based storage traffic to unauthorized virtual machine users. IP-based storage frequently is not encrypted. It can be viewed by anyone with access to this network. To restrict unauthorized users from viewing the IP-based storage traffic, the IP-based storage network must be logically separated from the production traffic. Configuring the IP-based storage adaptors on separate VLANs or network segments from other VMkernels and Virtual Machines will limit unauthorized users from viewing the traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-100295r1_fix">Configuration of an IP-Based VMkernel will be unique to each environment but for example to modify the IP address and VLAN information to the correct network on a standard switch for an iSCSI VMkernel do the following:
+
+From the vSphere Web Client select the ESXi host and go to Configure &gt;&gt; Networking &gt;&gt; VMkernel adapters. Select the Storage VMkernel (for vSAN only) and click Edit settings &gt;&gt; On the Port properties tab uncheck everything but "vSAN.” On the IP Settings tab &gt;&gt; Enter the appropriate IP address and subnet information and click OK.
+
+Set the appropriate VLAN ID &gt;&gt; Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Select the Storage portgroup (iSCSI, NFS, vSAN) and click Edit settings &gt;&gt; On the properties tab, enter the appropriate VLAN ID and click OK.</fixtext><fix id="F-100295r1_fix" /><check system="C-93365r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>IP-Based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a common standard or distributed virtual switch that is logically separated from other traffic types.  The check for this will be unique per environment.
+
+From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; VMkernel adapters and review the VLANs associated with any IP-Based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If any IP-Based storage networks are not isolated from other traffic types, this is a finding.
+
+If IP-based storage is not used, this is not applicable.</check-content></check></Rule></Group><Group id="V-94051"><title>SRG-OS-000423-VMM-001700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104137r1_rule" severity="low" weight="10.0"><version>ESXI-65-000052</version><title>The ESXi host must protect the confidentiality and integrity of transmitted information by utilizing different TCP/IP stacks where possible.</title><description>&lt;VulnDiscussion&gt;There are three different TCP/IP stacks by default available on ESXi now which are Default, Provisioning, and vMotion.  To better protect and isolate sensitive network traffic within ESXi admins must configure each of these stacks.  Additional custom TCP/IP stacks can be created if desired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-100299r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; TCP/IP configuration &gt;&gt; Select a TCP/IP stack &gt;&gt; Click Edit &gt;&gt; Enter the appropriate site specific IP address information for the particular TCP/IP stack and click OK.</fixtext><fix id="F-100299r1_fix" /><check system="C-93369r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; TCP/IP configuration. Review the default system TCP/IP stacks and verify they are configured with the appropriate IP address information.
+
+If vMotion and Provisioning VMKernels are in use and are not utilizing their own TCP/IP stack, this is a finding.</check-content></check></Rule></Group><Group id="V-94053"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104139r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000053</version><title>SNMP must be configured properly on the ESXi host.</title><description>&lt;VulnDiscussion&gt;If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100301r1_fix">To disable SNMP run the following command from a PowerCLI command prompt while connected to the ESXi Host:
+
+Get-VMHostSnmp | Set-VMHostSnmp -Enabled $false
+
+or
+
+From a console or ssh session run the follow command:
+
+esxcli system snmp set -e no
+
+To configure SNMP for v3 targets use the "esxcli system snmp set" command set.</fixtext><fix id="F-100301r1_fix" /><check system="C-93371r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostSnmp | Select *
+
+or
+
+From a console or ssh session run the follow command:
+
+esxcli system snmp get
+
+If SNMP is not in use and is enabled, this is a finding.
+
+If SNMP is enabled and read only communities is set to public, this is a finding.
+
+If SNMP is enabled and is not using v3 targets, this is a finding.
+
+Note: SNMP v3 targets can only be viewed and configured from the esxcli command.</check-content></check></Rule></Group><Group id="V-94055"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104141r1_rule" severity="low" weight="10.0"><version>ESXI-65-000054</version><title>The ESXi host must enable bidirectional CHAP authentication for iSCSI traffic.</title><description>&lt;VulnDiscussion&gt;When enabled, vSphere performs bidirectional authentication of both the iSCSI target and host. There is a potential for a MiTM attack, when not authenticating both the iSCSI target and host, in which an attacker might impersonate either side of the connection to steal data. Bidirectional authentication mitigates this risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100303r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Storage &gt;&gt; Storage Adapters &gt;&gt; Select the iSCSI adapter &gt;&gt; Properties &gt;&gt; Authentication and click the Edit button. Set Authentication method to “Use bidirectional CHAP” and enter a unique secret for each traffic flow direction.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostHba | Where {$_.Type -eq "iscsi"} | Set-VMHostHba -ChapType Required -ChapName "chapname" -ChapPassword "password" -MutualChapEnabled $true -MutualChapName "mutualchapname" -MutualChapPassword "mutualpassword"</fixtext><fix id="F-100303r1_fix" /><check system="C-93373r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Storage &gt;&gt; Storage Adapters &gt;&gt; Select the iSCSI adapter &gt;&gt; Properties &gt;&gt; Authentication method and view the CHAP configuration and verify CHAP is "Required" for target and host authentication.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostHba | Where {$_.Type -eq "iscsi"} | Select AuthenticationProperties -ExpandProperty AuthenticationProperties
+
+If iSCSI is not used, this is not a finding.
+
+If iSCSI is used and CHAP is not set to "Required" for both the target and host, this is a finding.
+
+If iSCSI is used and unique CHAP secrets are not used for each host, this is a finding.</check-content></check></Rule></Group><Group id="V-94057"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104143r1_rule" severity="low" weight="10.0"><version>ESXI-65-000055</version><title>The ESXi host must disable Inter-VM transparent page sharing.</title><description>&lt;VulnDiscussion&gt;Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try and determine an AES encryption key in use on another virtual machine running on the same physical processor of the host server if Transparent Page Sharing is enabled between the two virtual machines. This technique works only in a highly controlled system configured in a non-standard way that VMware believes would not be recreated in a production environment.
+
+Even though VMware believes information being disclosed in real world conditions is unrealistic, out of an abundance of caution upcoming ESXi Update releases will no longer enable TPS between Virtual Machines by default (TPS will still be utilized within individual VMs).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100305r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Mem.ShareForceSalting value and configure it to 2.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting | Set-AdvancedSetting -Value 2</fixtext><fix id="F-100305r1_fix" /><check system="C-93375r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Mem.ShareForceSalting value and verify it is set to 2.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting
+
+If the Mem.ShareForceSalting setting is not set to 2, this is a finding.</check-content></check></Rule></Group><Group id="V-94059"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104145r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000056</version><title>The ESXi host must configure the firewall to restrict access to services running on the host.</title><description>&lt;VulnDiscussion&gt;Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access. Reduce the risk by configuring the ESXi firewall to only allow access from authorized networks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100307r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under the Firewall section click Edit and for each enabled service uncheck the check box to “Allow connections from any IP address,” and input the site specific network(s) required.Configure this for Incoming and Outgoing connections.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+$esxcli = Get-EsxCli
+#This disables the allow all rule for the target service
+$esxcli.network.firewall.ruleset.set($false,$true,"sshServer")
+$esxcli.network.firewall.ruleset.allowedip.add("192.168.0.0/24","sshServer")
+
+This must be done for each enabled service.</fixtext><fix id="F-100307r1_fix" /><check system="C-93377r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under the Firewall section click Edit and for each enabled service click Firewall and review the allowed IPs. Check this for Incoming and Outgoing connections.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostFirewallException | Where {$_.Enabled -eq $true} | Select Name,Enabled,@{N="AllIPEnabled";E={$_.ExtensionData.AllowedHosts.AllIP}}
+
+If for an enabled service "Allow connections from any IP address" is selected, this is a finding.</check-content></check></Rule></Group><Group id="V-94061"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104147r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000057</version><title>The ESXi host must configure the firewall to block network traffic by default.</title><description>&lt;VulnDiscussion&gt;In addition to service specific firewall rules ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic.  Reduce the risk of attack by making sure this is set to deny incoming and outgoing traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100309r1_fix">From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostFirewallDefaultPolicy | Set-VMHostFirewallDefaultPolicy -AllowIncoming $false -AllowOutgoing $false</fixtext><fix id="F-100309r1_fix" /><check system="C-93379r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostFirewallDefaultPolicy
+
+If the Incoming or Outgoing policies are True, this is a finding.</check-content></check></Rule></Group><Group id="V-94063"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104149r1_rule" severity="low" weight="10.0"><version>ESXI-65-000058</version><title>The ESXi host must enable BPDU filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.</title><description>&lt;VulnDiscussion&gt;BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected to reduce the STP convergence delay. If a BPDU packet is sent from a virtual machine on the ESXi host to the physical switch so configured, a cascading lockout of all the uplink interfaces from the ESXi host can occur. To prevent this type of lockout, BPDU Filter can be enabled on the ESXi host to drop any BPDU packets being sent to the physical switch. The caveat is that certain SSL VPN which use Windows bridging capability can legitimately generate BPDU packets. The administrator should verify that there are no legitimate BPDU packets generated by virtual machines on the ESXi host prior to enabling BPDU Filter.  If BPDU Filter is enabled in this situation, enabling Reject Forged Transmits on the virtual switch port group adds protection against Spanning Tree loops.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100311r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Net.BlockGuestBPDU value and configure it to 1.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU | Set-AdvancedSetting -Value 1</fixtext><fix id="F-100311r1_fix" /><check system="C-93381r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.BlockGuestBPDU value and verify it is set to 1.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU
+
+If the Net.BlockGuestBPDU setting is not set to 1, this is a finding.</check-content></check></Rule></Group><Group id="V-94065"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104151r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000059</version><title>The virtual switch Forged Transmits policy must be set to reject on the ESXi host.</title><description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated source MAC address at any time. This allows an operating system to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network.
+
+This means the virtual switch does not compare the source and effective MAC addresses.
+
+To protect against MAC address impersonation, all virtual switches should have forged transmissions set to Reject. Reject Forged Transmit can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100313r1_fix">From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. For each virtual switch and port group click Edit settings and change "Forged Transmits" to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -ForgedTransmits $false
+Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -ForgedTransmitsInherited $true</fixtext><fix id="F-100313r1_fix" /><check system="C-93383r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Forged Transmits" policy is set to accept, this is a finding.</check-content></check></Rule></Group><Group id="V-94067"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104153r1_rule" severity="high" weight="10.0"><version>ESXI-65-000060</version><title>The virtual switch MAC Address Change policy must be set to reject on the ESXi host.</title><description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. Reject MAC Changes can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100315r1_fix">From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. For each virtual switch and port group click Edit settings and change "MAC Address Changes" to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -MacChanges $false
+Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -MacChangesInherited $true</fixtext><fix id="F-100315r1_fix" /><check system="C-93385r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "MAC Address Changes" policy is set to accept, this is a finding.</check-content></check></Rule></Group><Group id="V-94069"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104155r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000061</version><title>The virtual switch Promiscuous Mode policy must be set to reject on the ESXi host.</title><description>&lt;VulnDiscussion&gt;When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that Portgroup. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting. Promiscous mode can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100317r1_fix">From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. For each virtual switch and port group click Edit settings and change "Promiscuous Mode" to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -AllowPromiscuous $false
+Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -AllowPromiscuousInherited $true</fixtext><fix id="F-100317r1_fix" /><check system="C-93387r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Promiscuous Mode" policy is set to accept, this is a finding.</check-content></check></Rule></Group><Group id="V-94071"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104157r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000062</version><title>The ESXi host must prevent unintended use of the dvFilter network APIs.</title><description>&lt;VulnDiscussion&gt;If you are not using products that make use of the dvfilter network API, the host should not be configured to send network information to a VM. If the API is enabled an attacker might attempt to connect a VM to it thereby potentially providing access to the network of other VMs on the host. If you are using a product that makes use of this API then verify that the host has been configured correctly. If you are not using such a product make sure the setting is blank.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100319r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Net.DVFilterBindIpAddress value and remove any incorrect addresses.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.DVFilterBindIpAddress | Set-AdvancedSetting -Value ""</fixtext><fix id="F-100319r1_fix" /><check system="C-93389r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.DVFilterBindIpAddress value and verify the value is blank or the correct IP address of a security appliance if in use.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.DVFilterBindIpAddress
+
+If the Net.DVFilterBindIpAddress is not blank and security appliances are not in use on the host, this is a finding.</check-content></check></Rule></Group><Group id="V-94073"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104159r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000063</version><title>For the ESXi host all port groups must be configured to a value other than that of the native VLAN.</title><description>&lt;VulnDiscussion&gt;ESXi does not use the concept of native VLAN. Frames with VLAN specified in the port group will have a tag, but frames with VLAN not specified in the port group are not tagged and therefore will end up as belonging to native VLAN of the physical switch. For example, frames on VLAN 1 from a Cisco physical switch will be untagged, because this is considered as the native VLAN. However, frames from ESXi specified as VLAN 1 will be tagged with a "1"; therefore, traffic from ESXi that is destined for the native VLAN will not be correctly routed (because it is tagged with a "1" instead of being untagged), and traffic from the physical switch coming from the native VLAN will not be visible (because it is not tagged). If the ESXi virtual switch port group uses the native VLAN ID, traffic from those VMs will not be visible to the native VLAN on the switch, because the switch is expecting untagged traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100321r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Highlight a port group (where VLAN ID set to native VLAN ID) and click Edit settings. Change the VLAN ID to a non-native VLAN and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup -Name "portgroup name" | Set-VirtualPortGroup -VLanId "New VLAN#"</fixtext><fix id="F-100321r1_fix" /><check system="C-93391r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to the native VLAN ID of the attached physical switch.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with the native VLAN of the ESXi hosts attached physical switch, this is a finding.</check-content></check></Rule></Group><Group id="V-94075"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104161r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000064</version><title>For the ESXi host all port groups must not be configured to VLAN 4095 unless Virtual Guest Tagging (VGT) is required.</title><description>&lt;VulnDiscussion&gt;When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes all network frames to the guest VM without modifying the VLAN tags, leaving it up to the guest to deal with them. VLAN 4095 should be used only if the guest has been specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it might cause denial-of-service or allow a guest VM to interact with traffic on an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100323r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Highlight a port group (where VLAN ID set to 4095) and click Edit settings. Change the VLAN ID to not be 4095 and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup -Name "portgroup name" | Set-VirtualPortGroup -VLanId "New VLAN#"</fixtext><fix id="F-100323r1_fix" /><check system="C-93393r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to 4095.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanID
+
+If any port group is configured with VLAN 4095 and is not documented as a needed exception, this is a finding.</check-content></check></Rule></Group><Group id="V-94077"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104163r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000065</version><title>For the ESXi host all port groups must not be configured to VLAN values reserved by upstream physical switches.</title><description>&lt;VulnDiscussion&gt;Certain physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001–1024 and 4094, while Nexus switches typically reserve 3968–4047 and 4094. Check with the documentation for your specific switch. Using a reserved VLAN might result in a denial of service on the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100325r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Highlight a port group (where VLAN ID set to 4095) and click Edit settings (pencil). Change the VLAN ID to not be a reserved VLAN ID and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup -Name "portgroup name" | Set-VirtualPortGroup -VLanId "New VLAN#"</fixtext><fix id="F-100325r1_fix" /><check system="C-93395r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to a reserved VLAN ID.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with a reserved VLAN ID, this is a finding.</check-content></check></Rule></Group><Group id="V-94079"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104165r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000066</version><title>For physical switch ports connected to the ESXi host, the non-negotiate option must be configured for trunk links between external physical switches and virtual switches in VST mode.</title><description>&lt;VulnDiscussion&gt;In order to communicate with virtual switches in VST mode, external switch ports must be configured as trunk ports. VST mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. The auto or desirable physical switch settings do not work with the ESXi Server because the physical switch communicates with the ESXi Server using DTP. The non-negotiate and on options unconditionally enable VLAN trunking on the physical switch and create a VLAN trunk link between the ESXi Server and the physical switch. The difference between non-negotiate and on options is that on mode still sends out DTP frames, whereas the non-negotiate option does not.  The non-negotiate option should be used for all VLAN trunks, to minimize unnecessary network traffic for virtual switches in VST mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100327r1_fix">Note that this check refers to an entity outside the physical scope of the ESXi server system. Document the configuration of external switch ports as trunk ports. Log in to the vendor-specific physical switch and disable DTP on the physical switch ports connected to the ESXi Host. Update the documentation on an organization defined frequency or whenever modifications are made to either ESXi hosts or the upstream external switch ports.</fixtext><fix id="F-100327r1_fix" /><check system="C-93397r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of external switch ports as trunk ports must be documented. Virtual Switch Tagging (VST) mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. Inspect the documentation and verify that the documentation is correct and updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream external switch ports.
+
+If DTP is enabled on the physical switch ports connected to the ESXi Host, this is a finding.</check-content></check></Rule></Group><Group id="V-94081"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104167r1_rule" severity="low" weight="10.0"><version>ESXI-65-000067</version><title>All ESXi host-connected physical switch ports must be configured with spanning tree disabled.</title><description>&lt;VulnDiscussion&gt;Since VMware virtual switches do not support STP, the ESXi host-connected physical switch ports must have portfast configured if spanning tree is enabled to avoid loops within the physical switch network. If these are not set, potential performance and connectivity issues might arise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100329r1_fix">Note that this check refers to an entity outside the scope of the ESXi server system. Document the upstream physical switch configuration for spanning tree protocol disablement and/or portfast configuration for all physical ports connected to ESXi hosts. Log in to the physical switch(es) and disable spanning tree protocol and/or configure portfast for all physical ports connected to ESXi hosts. Update the documentation on an organization defined frequency or whenever modifications are made to either ESXi hosts or the upstream physical switches.</fixtext><fix id="F-100329r1_fix" /><check system="C-93399r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's spanning tree protocol is not disabled or portfast is not configured for all physical ports connected to ESXi hosts, this is a finding.</check-content></check></Rule></Group><Group id="V-94083"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104169r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000068</version><title>All ESXi host-connected virtual switch VLANs must be fully documented and have only the required VLANs.</title><description>&lt;VulnDiscussion&gt;When defining a physical switch port for trunk mode, only specified VLANs must be configured on the VLAN trunk link. The risk with not fully documenting all VLANs on the vSwitch is that it is possible that a physical trunk port might be configured without needed VLANs, or with unneeded VLANs, potentially enabling an administrator to either accidentally or maliciously connect a VM to an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100331r1_fix">Note that this check refers to an entity outside the scope of the ESXi server system.
+
+Remove any VLANs trunked across physical ports connected to ESXi hosts that are not in use.</fixtext><fix id="F-100331r1_fix" /><check system="C-93401r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that unneeded VLANs are configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that only needed VLANs are configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's configuration is trunked VLANs that are not used by ESXi for all physical ports connected to ESXi hosts, this is a finding.</check-content></check></Rule></Group><Group id="V-94349"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104303r2_rule" severity="medium" weight="10.0"><version>ESXI-65-000070</version><title>The ESXi host must not provide root/administrator level access to CIM-based hardware monitoring tools or other third-party applications.</title><description>&lt;VulnDiscussion&gt;The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server.  Place this user in the Exception Users list.  When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100465r2_fix">Create a role for the CIM account.
+
+From the Host Client, go to manage, then Security &amp; Users. Select Roles then click Add Role. Provide a name for the new role then select Host &gt;&gt; Cim &gt;&gt; Ciminteraction and click Add.
+
+Add a CIM user account.
+
+From the Host Client, go to manage, then Security &amp; Users. Select Users then click Add User. Provide a name, description, and password for the new user then click Add.
+
+Assign the CIM account permissions to the host with the new role.
+
+From the Host Client, select the ESXi host, right click and go to "Permissions". Click Add User and select the CIM account from the drop down list and select the new CIM role from the drop down list and click Add User.</fixtext><fix id="F-100465r2_fix" /><check system="C-93535r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server. Place this user in the Exception Users list. When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.
+
+From the Host Client, select the ESXi host, right click and go to "Permissions". Verify the CIM account user role is limited to read only and CIM permissions.
+
+If there is no dedicated CIM account and the root is used for CIM monitoring, this is a finding.
+
+If write access is not required and the access level is not "read-only", this is a finding.</check-content></check></Rule></Group><Group id="V-94477"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104307r1_rule" severity="high" weight="10.0"><version>ESXI-65-000071</version><title>The ESXi host must verify the integrity of the installation media before installing ESXi.</title><description>&lt;VulnDiscussion&gt;Always check the SHA1 or MD5 hash after downloading an ISO, offline bundle, or patch to ensure integrity and authenticity of the downloaded files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100593r1_fix">If the hash returned from the md5sum or sha1sum commands do not match the vendor's hash, the downloaded software must be discarded.
+
+If the physical media is obtained from VMware and the security seal is broken, the software must be returned to VMware for replacement.</fixtext><fix id="F-100593r1_fix" /><check system="C-93601r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>The downloaded ISO, offline bundle, or patch hash must be verified against the vendor's checksum to ensure the integrity and authenticity of the files.
+
+See some typical command line example(s) for both the md5 and sha1 hash check(s) directly below.
+
+# md5sum &lt;filename&gt;.iso
+# sha1sum &lt;filename&gt;.iso
+
+If any of the system's downloaded ISO, offline bundle, or system patch hashes cannot be verified against the vendor's checksum, this is a finding.</check-content></check></Rule></Group><Group id="V-94479"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104309r1_rule" severity="high" weight="10.0"><version>ESXI-65-000072</version><title>The ESXi host must have all security patches and updates installed.</title><description>&lt;VulnDiscussion&gt;Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100595r1_fix">If vCenter Update Manager is used on the network, hosts can be remediated from the vSphere Web Client. From the vSphere Web Client go to Hosts and Clusters &gt;&gt; Update Manager tab and select a non-compliant host and click the Remediate button.
+
+To manually remediate a host the patch file must be copied locally and the following command run from an SSH session connected to the ESXi host, or from the ESXi shell:
+
+esxcli software vib update -d &lt;path to offline patch bundle.zip&gt;</fixtext><fix id="F-100595r1_fix" /><check system="C-93665r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>If vCenter Update Manager is used on the network it can be used to scan all hosts for missing patches.  From the vSphere Client go to Hosts and Clusters &gt; Update Manager tab and select scan to view all hosts compliance status.
+
+If vCenter Update Manager is not used a hosts compliance status must be manually determined by the build number.  The following VMware KB 1014508 can be used to correlate patches with build numbers.
+
+If the ESXi host does not have the latest patches, this is a finding.
+
+If the ESXi host is not on a supported release, this is a finding.
+
+VMware also publishes Advisories on security patches, and offers a way to subscribe to email alerts for them.
+https://www.vmware.com/support/policies/security_response</check-content></check></Rule></Group><Group id="V-94487"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104317r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000076</version><title>The ESXi host must enable Secure Boot.</title><description>&lt;VulnDiscussion&gt;Secure Boot is a protocol of UEFI firmware that ensures the integrity of the boot process from hardware up through to the OS. Secure Boot for ESXi requires support from the firmware and it requires that all ESXi kernel modules, drivers, and VIBs be signed by VMware or a partner subordinate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100603r2_fix">Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -c
+
+If the output indicates that Secure Boot cannot be enabled, correct the discrepancies and try again. If the discrepancies cannot be rectified this finding is downgraded to a CAT III.
+
+Consult your vendor documentation and boot the host into BIOS setup mode. Enable UEFI boot mode and Secure Boot. Restart the host.
+
+Temporarily enable SSH, connect to the ESXi host and run the following command to verify that Secure Boot is enabled:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -s</fixtext><fix id="F-100603r2_fix" /><check system="C-93673r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -s
+
+If the output is not Enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-94489"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104319r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000078</version><title>The ESXi host must use DoD-approved certificates.</title><description>&lt;VulnDiscussion&gt;The default self-signed, VMCA issued host certificate must be replaced with a DoD-approved certificate. The use of a DoD certificate on the host assures clients that the service they are connecting to is legitimate and properly secured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100605r2_fix">Obtain a DoD issued certificate and private key for the host following the below requirements:
+
+Key size: 2048 bits or more (PEM encoded)
+Key format: PEM. VMware supports PKCS8 and PKCS1 (RSA keys)
+x509 version 3
+SubjectAltName must contain DNS Name=&lt;machine_FQDN&gt;
+CRT (Base-64) format
+Contains the following Key Usages: Digital Signature, Non Repudiation, Key Encipherment
+Start time of one day before the current time
+CN (and SubjectAltName) set to the host name (or IP address) that the ESXi host has in the vCenter Server inventory.
+
+Put the host into maintenance mode.
+
+Temporarily enable SSH on the host. SCP the new certificate and key to /tmp. SSH to the host. Back up the existing certificate and key:
+
+mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.bak
+mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.bak
+
+Copy your new certificate and key to /etc/vmware/ssl/ and rename them to rui.crt and rui.key respectively. Restart management agents to implement the new certificate:
+
+services.sh restart
+
+From the vSphere Web Client go to vCenter Inventory Lists &gt;&gt; vCenter Servers &gt;&gt; Select your vCenter Server &gt;&gt; Manage &gt;&gt; Settings &gt;&gt; Advanced Settings. Find or create the vpxd.certmgmt.mode key and set its value to custom.</fixtext><fix id="F-100605r2_fix" /><check system="C-93675r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+# openssl x509 -in /etc/vmware/ssl/rui.crt -text | grep Issuer
+
+If the issuer is not a DoD approved certificate authority, this is a finding.</check-content></check></Rule></Group><Group id="V-94505"><title>SRG-OS-000109-VMM-000550</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104335r2_rule" severity="low" weight="10.0"><version>ESXI-65-100037</version><title>The ESXi host must require individuals to be authenticated with an individual authenticator prior to using a group authenticator by using Active Directory for local user authentication.</title><description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000770</ident><fixtext fixref="F-100621r1_fix">From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services.  Click "Properties" and change the "Directory Service Type" to "Active Directory", enter the domain to join, check "Use vSphere Authentication Proxy" and enter the proxy server address then click "Join Domain".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain -Domain "domain name" -User "username" -Password "password"</fixtext><fix id="F-100621r1_fix" /><check system="C-93693r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser"", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-100543"><title>SRG-OS-000423-VMM-001700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109647r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000049</version><title>The ESXi host must protect the confidentiality and integrity of transmitted information by protecting ESXi management traffic.</title><description>&lt;VulnDiscussion&gt;The vSphere management network provides access to the vSphere management interface on each component. Services running on the management interface provide an opportunity for an attacker to gain privileged access to the systems. Any remote attack most likely would begin with gaining entry to this network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-106229r1_fix">From the vSphere Web Client select the ESXi host and go to Configure &gt;&gt; Networking &gt;&gt; VMkernel adapters. Select the Management VMkernel and click Edit settings &gt;&gt; On the Port properties tab uncheck everything but "Management.” On the IP Settings tab &gt;&gt; Enter the appropriate IP address and subnet information and click OK. Set the appropriate VLAN ID &gt;&gt; Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Select the Management portgroup and click Edit settings &gt;&gt; On the properties tab, enter the appropriate VLAN ID and click OK.</fixtext><fix id="F-106229r1_fix" /><check system="C-99401r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>The Management VMkernel port group should in a dedicated VLAN that can be on a common standard or distributed virtual switch as long as the Management VLAN is not shared by any other function and it not accessible to anything other than management related functions such as vCenter.  The check for this will be unique per environment.
+
+From the vSphere Web Client select the ESXi host and go to Configure &gt;&gt; Networking and review the VLAN associated with the Management VMkernel and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If the network segment is accessible, except to networks where other management-related entities are located such as vCenter, this is a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/source/StigData/Archive/Vsphere/U_VMware_vSphere_6-5_ESXi_STIG_V1R3_Manual-xccdf.log b/source/StigData/Archive/Vsphere/U_VMware_vSphere_6-5_ESXi_STIG_V1R3_Manual-xccdf.log
new file mode 100644
index 000000000..e822876dd
--- /dev/null
+++ b/source/StigData/Archive/Vsphere/U_VMware_vSphere_6-5_ESXi_STIG_V1R3_Manual-xccdf.log
@@ -0,0 +1,2 @@
+V-94349::From the Host Client, select the ESXi host, right click and go to "Permissions". Verify the CIM account user role is limited to read only and CIM permissions.::""
+V-93953::If the Exception users list contains accounts that do not require special permissions, this is a finding.::""
diff --git a/source/StigData/Archive/Vsphere/U_VMware_vSphere_6-5_ESXi_STIG_V1R3_Manual-xccdf.xml b/source/StigData/Archive/Vsphere/U_VMware_vSphere_6-5_ESXi_STIG_V1R3_Manual-xccdf.xml
new file mode 100644
index 000000000..e48b9421c
--- /dev/null
+++ b/source/StigData/Archive/Vsphere/U_VMware_vSphere_6-5_ESXi_STIG_V1R3_Manual-xccdf.xml
@@ -0,0 +1,1197 @@
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="VMware_vSphere_6-5_ESXi_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-12-13">accepted</status><title>VMware vSphere 6.5 ESXi Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 3 Benchmark Date: 24 Jan 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-93949" selected="true" /><select idref="V-93951" selected="true" /><select idref="V-93953" selected="true" /><select idref="V-93955" selected="true" /><select idref="V-93957" selected="true" /><select idref="V-93959" selected="true" /><select idref="V-93961" selected="true" /><select idref="V-93963" selected="true" /><select idref="V-93965" selected="true" /><select idref="V-93967" selected="true" /><select idref="V-93969" selected="true" /><select idref="V-93971" selected="true" /><select idref="V-93973" selected="true" /><select idref="V-93975" selected="true" /><select idref="V-93977" selected="true" /><select idref="V-93979" selected="true" /><select idref="V-93981" selected="true" /><select idref="V-93983" selected="true" /><select idref="V-93985" selected="true" /><select idref="V-93987" selected="true" /><select idref="V-93989" selected="true" /><select idref="V-93991" selected="true" /><select idref="V-93993" selected="true" /><select idref="V-93995" selected="true" /><select idref="V-93997" selected="true" /><select idref="V-93999" selected="true" /><select idref="V-94001" selected="true" /><select idref="V-94003" selected="true" /><select idref="V-94005" selected="true" /><select idref="V-94007" selected="true" /><select idref="V-94009" selected="true" /><select idref="V-94011" selected="true" /><select idref="V-94013" selected="true" /><select idref="V-94015" selected="true" /><select idref="V-94017" selected="true" /><select idref="V-94019" selected="true" /><select idref="V-94021" selected="true" /><select idref="V-94023" selected="true" /><select idref="V-94025" selected="true" /><select idref="V-94027" selected="true" /><select idref="V-94029" selected="true" /><select idref="V-94031" selected="true" /><select idref="V-94033" selected="true" /><select idref="V-94035" selected="true" /><select idref="V-94037" selected="true" /><select idref="V-94039" selected="true" /><select idref="V-94041" selected="true" /><select idref="V-94043" selected="true" /><select idref="V-94047" selected="true" /><select idref="V-94051" selected="true" /><select idref="V-94053" selected="true" /><select idref="V-94055" selected="true" /><select idref="V-94057" selected="true" /><select idref="V-94059" selected="true" /><select idref="V-94061" selected="true" /><select idref="V-94063" selected="true" /><select idref="V-94065" selected="true" /><select idref="V-94067" selected="true" /><select idref="V-94069" selected="true" /><select idref="V-94071" selected="true" /><select idref="V-94073" selected="true" /><select idref="V-94075" selected="true" /><select idref="V-94077" selected="true" /><select idref="V-94079" selected="true" /><select idref="V-94081" selected="true" /><select idref="V-94083" selected="true" /><select idref="V-94349" selected="true" /><select idref="V-94477" selected="true" /><select idref="V-94479" selected="true" /><select idref="V-94481" selected="true" /><select idref="V-94483" selected="true" /><select idref="V-94487" selected="true" /><select idref="V-94489" selected="true" /><select idref="V-94505" selected="true" /><select idref="V-94507" selected="true" /><select idref="V-94509" selected="true" /><select idref="V-94511" selected="true" /><select idref="V-94529" selected="true" /><select idref="V-94531" selected="true" /><select idref="V-94533" selected="true" /><select idref="V-94535" selected="true" /><select idref="V-94543" selected="true" /><select idref="V-94545" selected="true" /><select idref="V-94547" selected="true" /><select idref="V-94549" selected="true" /></Profile><Group id="V-93949"><title>SRG-OS-000027-VMM-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104035r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000001</version><title>The ESXi host must limit the number of concurrent sessions to ten for all accounts and/or account types by enabling lockdown mode.</title><description>&lt;VulnDiscussion&gt;Enabling lockdown mode disables direct access to an ESXi host requiring the host be managed remotely from vCenter Server. This is done to ensure the roles and access controls implemented in vCenter are always enforced and users cannot bypass them by logging into a host directly. By forcing all interaction to occur through vCenter Server, the risk of someone inadvertently attaining elevated privileges or performing tasks that are not properly audited is greatly reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-100197r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Click edit on "Lockdown Mode" and set to Enabled (Normal or Strict).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$level = "lockdownNormal" OR "lockdownStrict"
+$vmhost = Get-VMHost -Name &lt;hostname&gt; | Get-View
+$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
+$lockdown.ChangeLockdownMode($level)
+
+Note: In strict lockdown mode the DCUI service is stopped. If the connection to vCenter Server is lost and the vSphere Web Client is no longer available, the ESXi host becomes inaccessible.</fixtext><fix id="F-100197r1_fix" /><check system="C-93267r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Scroll down to "Lockdown Mode" and verify it is set to Enabled (Normal or Strict).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}
+
+If Lockdown Mode is disabled, this is a finding. 
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-93951"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104037r1_rule" severity="low" weight="10.0"><version>ESXI-65-000002</version><title>The ESXi host must verify the DCUI.Access list.</title><description>&lt;VulnDiscussion&gt;Lockdown mode disables direct host access requiring that admins manage hosts from vCenter Server.  However, if a host becomes isolated from vCenter Server, the admin is locked out and can no longer manage the host. If you are using normal lockdown mode, you can avoid becoming locked out of an ESXi host that is running in lockdown mode, by setting DCUI.Access to a list of highly trusted users who can override lockdown mode and access the DCUI. The DCUI is not running in strict lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100199r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Click Edit and select the DCUI.Access value and configure it to root.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name DCUI.Access | Set-AdvancedSetting -Value "root"</fixtext><fix id="F-100199r1_fix" /><check system="C-93269r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the DCUI.Access value and verify only the root user is listed.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.
+
+If the DCUI.Access is not restricted to root, this is a finding.
+
+Note: This list is only for local user accounts and should only contain the root user.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-93953"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104039r1_rule" severity="low" weight="10.0"><version>ESXI-65-000003</version><title>The ESXi host must verify the exception users list for lockdown mode.</title><description>&lt;VulnDiscussion&gt;In vSphere you can add users to the Exception Users list from the vSphere Web Client. These users do not lose their permissions when the host enters lockdown mode. Usually you may want to add service accounts such as a backup agent to the Exception Users list. Verify that the list of users who are exempted from losing permissions is legitimate and as needed per your environment. Users who do not require special permissions should not be exempted from lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100201r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under lockdown mode click Edit and remove unnecessary users to the exceptions list.</fixtext><fix id="F-100201r1_fix" /><check system="C-93271r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under lockdown mode review the exception users list.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following script:
+
+$vmhost = Get-VMHost | Get-View
+$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
+$lockdown.QueryLockdownExceptions()
+
+If the Exception users list contains accounts that do not require special permissions, this is a finding.
+
+Note - This list is not intended for system administrator accounts but for special circumstances such as a service account.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-93955"><title>SRG-OS-000032-VMM-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104041r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000004</version><title>Remote logging for ESXi hosts must be configured.</title><description>&lt;VulnDiscussion&gt;Remote logging to a central log host provides a secure, centralized store for ESXi logs. By gathering host log files onto a central host it can more easily monitor all hosts with a single tool. It can also do aggregate analysis and searching to look for such things as coordinated attacks on multiple hosts. Logging to a secure, centralized log server also helps prevent log tampering and also provides a long-term audit record.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000067</ident><fixtext fixref="F-100203r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Syslog.global.logHost value and configure it to a site specific syslog server.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost | Set-AdvancedSetting -Value "&lt;syslog server hostname&gt;"</fixtext><fix id="F-100203r1_fix" /><check system="C-93273r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Syslog.global.logHost value and verify it is set to a site specific syslog server hostname.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost
+
+If the Syslog.global.logHost setting is not set to a site specific syslog server, this is a finding.</check-content></check></Rule></Group><Group id="V-93957"><title>SRG-OS-000021-VMM-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104043r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000005</version><title>The ESXi host must enforce the limit of three consecutive invalid logon attempts by a user.</title><description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000044</ident><fixtext fixref="F-100205r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Security.AccountLockFailures value and configure it to 3.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures | Set-AdvancedSetting -Value 3</fixtext><fix id="F-100205r1_fix" /><check system="C-93275r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountLockFailures value and verify it is set to 3.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures and verify it is set to 3.
+
+If the Security.AccountLockFailures is set to a value other than 3, this is a finding.</check-content></check></Rule></Group><Group id="V-93959"><title>SRG-OS-000329-VMM-001180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104045r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000006</version><title>The ESXi host must enforce the unlock timeout of 15 minutes after a user account is locked out.</title><description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002238</ident><fixtext fixref="F-100207r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Security.AccountUnlockTime value and configure it to 900.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime | Set-AdvancedSetting -Value 900</fixtext><fix id="F-100207r1_fix" /><check system="C-93277r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountUnlockTime value and verify it is set to 900.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime and verify it is set to 900.
+
+If the Security.AccountUnlockTime is set to a value other than 900, this is a finding.</check-content></check></Rule></Group><Group id="V-93961"><title>SRG-OS-000023-VMM-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104047r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000007</version><title>The ESXi host must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</title><description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000048</ident><fixtext fixref="F-100209r1_fix">From a PowerCLI command prompt while connected to the ESXi host copy the following contents into a script(.ps1 file) and run to set the DCUI screen to display the DoD logon banner:
+
+&lt;script begin&gt;
+
+$value = @"
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{hostname} , {ip}{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{esxproduct} {esxversion}{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{memory} RAM{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:white}        {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By      {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  using this IS (which includes any device attached to this IS), you consent to the following conditions:                 {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited     {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law      {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          enforcement (LE), and counterintelligence (CI) investigations.                                                  {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       At any time, the USG may inspect and seize data stored on this IS.                                              {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       Communications using, or data stored on, this IS are not private, are subject to routine monitoring,            {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          interception, and search, and may be disclosed or used for any USG-authorized purpose.                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not     {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          for your personal benefit or privacy.                                                                           {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}  -       Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching    {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          or monitoring of the content of privileged communications, or work product, related to personal representation  {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work       {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}          product are private and confidential. See User Agreement for details.                                           {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black}                                                                                                                          {/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+{bgcolor:black} {/color}{align:left}{bgcolor:dark-grey}{color:white}  &lt;F2&gt; Accept Conditions and Customize System / View Logs{/align}{align:right}&lt;F12&gt; Accept Conditions and Shut Down/Restart  {bgcolor:black} {/color}{/color}{/bgcolor}{/align}
+{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black}                                                                                                                          {/color}{/bgcolor}
+"@
+
+Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage | Set-AdvancedSetting -Value $value
+
+&lt;script end&gt;</fixtext><fix id="F-100209r1_fix" /><check system="C-93279r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Annotations.WelcomeMessage value and verify it contains the DoD logon banner to follow.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage
+
+Check for either of the following login banners based on the character limitations imposed by the system. An exact match of the text is required. If one of these banners is not displayed, this is a finding.
+
+You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+-At any time, the USG may inspect and seize data stored on this IS.
+
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests- -not for your personal benefit or privacy.
+
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
+
+OR
+
+I've read &amp; consent to terms in IS user agreem't.
+
+If the DCUI logon screen does not display the DoD logon banner, this is a finding.</check-content></check></Rule></Group><Group id="V-93963"><title>SRG-OS-000023-VMM-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104049r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000008</version><title>The ESXi host must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</title><description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000048</ident><fixtext fixref="F-100211r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.Etc.issue value and set it to the following.
+
+"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue | Set-AdvancedSetting -Value "&lt;insert logon banner&gt;"</fixtext><fix id="F-100211r1_fix" /><check system="C-93281r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.Etc.issue value and verify it is set to DoD logon banner below.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue
+
+If the Config.Etc.issue setting (/etc/issue file) does not contain the logon banner exactly as shown below this is a finding.
+
+"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."</check-content></check></Rule></Group><Group id="V-93965"><title>SRG-OS-000023-VMM-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104051r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000009</version><title>The ESXi host SSH daemon must be configured with the Department of Defense (DoD) login banner.</title><description>&lt;VulnDiscussion&gt;The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000048</ident><fixtext fixref="F-100213r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Banner /etc/issue</fixtext><fix id="F-100213r1_fix" /><check system="C-93283r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Banner" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Banner /etc/issue", this is a finding.</check-content></check></Rule></Group><Group id="V-93967"><title>SRG-OS-000033-VMM-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104053r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000010</version><title>The ESXi host SSH daemon must use DoD-approved encryption to protect the confidentiality of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Approved algorithms should impart some level of confidence in their implementation. Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
+
+Note: This does not imply FIPS 140-2 validation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-100215r1_fix">Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. 
+
+From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config": 
+
+Ciphers aes128-ctr,aes192-ctr,aes256-ctr</fixtext><fix id="F-100215r1_fix" /><check system="C-93285r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command from an SSH session connected to the ESXi host, or from the ESXi shell: 
+
+# grep -i "^Ciphers" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Ciphers aes128-ctr,aes192-ctr,aes256-ctr", this is a finding.</check-content></check></Rule></Group><Group id="V-93969"><title>SRG-OS-000033-VMM-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104055r1_rule" severity="high" weight="10.0"><version>ESXI-65-000011</version><title>The ESXi host SSH daemon must be configured to use only the SSHv2 protocol.</title><description>&lt;VulnDiscussion&gt;SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used. Only SSH protocol version 2 connections should be permitted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-100217r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config":
+
+Protocol 2</fixtext><fix id="F-100217r1_fix" /><check system="C-93287r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Protocol" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Protocol 2", this is a finding.</check-content></check></Rule></Group><Group id="V-93971"><title>SRG-OS-000107-VMM-000530</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104057r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000012</version><title>The ESXi host SSH daemon must ignore .rhosts files.</title><description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via ".rhosts" files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000767</ident><fixtext fixref="F-100219r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config": 
+
+IgnoreRhosts yes</fixtext><fix id="F-100219r1_fix" /><check system="C-93289r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^IgnoreRhosts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "IgnoreRhosts yes", this is a finding.</check-content></check></Rule></Group><Group id="V-93973"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104059r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000013</version><title>The ESXi host SSH daemon must not allow host-based authentication.</title><description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptographic host-based authentication is more secure than ".rhosts" authentication, since hosts are cryptographically authenticated. However, it is not recommended that hosts unilaterally trust one another, even within an organization.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100221r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config": 
+
+HostbasedAuthentication no</fixtext><fix id="F-100221r1_fix" /><check system="C-93291r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^HostbasedAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "HostbasedAuthentication no", this is a finding.</check-content></check></Rule></Group><Group id="V-93975"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104061r1_rule" severity="low" weight="10.0"><version>ESXI-65-000014</version><title>The ESXi host SSH daemon must not permit root logins.</title><description>&lt;VulnDiscussion&gt;Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100223r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Add or correct the following line in "/etc/ssh/sshd_config": 
+
+PermitRootLogin no</fixtext><fix id="F-100223r1_fix" /><check system="C-93293r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitRootLogin" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitRootLogin no", this is a finding.</check-content></check></Rule></Group><Group id="V-93977"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104063r1_rule" severity="high" weight="10.0"><version>ESXI-65-000015</version><title>The ESXi host SSH daemon must not allow authentication using an empty password.</title><description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100225r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+PermitEmptyPasswords no</fixtext><fix id="F-100225r1_fix" /><check system="C-93295r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitEmptyPasswords" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitEmptyPasswords no", this is a finding.</check-content></check></Rule></Group><Group id="V-93979"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104065r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000016</version><title>The ESXi host SSH daemon must not permit user environment settings.</title><description>&lt;VulnDiscussion&gt;SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100227r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+PermitUserEnvironment no</fixtext><fix id="F-100227r1_fix" /><check system="C-93297r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitUserEnvironment" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitUserEnvironment no", this is a finding.</check-content></check></Rule></Group><Group id="V-93981"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104067r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000017</version><title>The ESXi host SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.</title><description>&lt;VulnDiscussion&gt;DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100229r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512</fixtext><fix id="F-100229r1_fix" /><check system="C-93299r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MACs" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512", this is a finding.</check-content></check></Rule></Group><Group id="V-93983"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104069r1_rule" severity="low" weight="10.0"><version>ESXI-65-000018</version><title>The ESXi host SSH daemon must not permit GSSAPI authentication.</title><description>&lt;VulnDiscussion&gt;GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100231r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+GSSAPIAuthentication no</fixtext><fix id="F-100231r1_fix" /><check system="C-93301r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GSSAPIAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GSSAPIAuthentication no", this is a finding.</check-content></check></Rule></Group><Group id="V-93985"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104071r1_rule" severity="low" weight="10.0"><version>ESXI-65-000019</version><title>The ESXi host SSH daemon must not permit Kerberos authentication.</title><description>&lt;VulnDiscussion&gt;Kerberos authentication for SSH is often implemented using GSSAPI.  If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation.  Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation.  To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100233r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+KerberosAuthentication no</fixtext><fix id="F-100233r1_fix" /><check system="C-93303r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^KerberosAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "KerberosAuthentication no", this is a finding.</check-content></check></Rule></Group><Group id="V-93987"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104073r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000020</version><title>The ESXi host SSH daemon must perform strict mode checking of home directory configuration files.</title><description>&lt;VulnDiscussion&gt;If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100235r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+StrictModes yes</fixtext><fix id="F-100235r1_fix" /><check system="C-93305r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^StrictModes" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "StrictModes yes", this is a finding.</check-content></check></Rule></Group><Group id="V-93989"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104075r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000021</version><title>The ESXi host SSH daemon must not allow compression or must only allow compression after successful authentication.</title><description>&lt;VulnDiscussion&gt;If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100237r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+Compression no</fixtext><fix id="F-100237r1_fix" /><check system="C-93307r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Compression" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Compression no", this is a finding.</check-content></check></Rule></Group><Group id="V-93991"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104077r1_rule" severity="low" weight="10.0"><version>ESXI-65-000022</version><title>The ESXi host SSH daemon must be configured to not allow gateway ports.</title><description>&lt;VulnDiscussion&gt;SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs. Gateway ports allow remote forwarded ports to bind to non-loopback addresses on the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100239r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+GatewayPorts no</fixtext><fix id="F-100239r1_fix" /><check system="C-93309r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GatewayPorts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GatewayPorts no", this is a finding.</check-content></check></Rule></Group><Group id="V-93993"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104079r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000023</version><title>The ESXi host SSH daemon must be configured to not allow X11 forwarding.</title><description>&lt;VulnDiscussion&gt;X11 forwarding over SSH allows for the secure remote execution of X11-based applications. This feature can increase the attack surface of an SSH connection.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100241r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+X11Forwarding no</fixtext><fix id="F-100241r1_fix" /><check system="C-93311r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^X11Forwarding" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "X11Forwarding no", this is a finding.</check-content></check></Rule></Group><Group id="V-93995"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104081r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000024</version><title>The ESXi host SSH daemon must not accept environment variables from the client.</title><description>&lt;VulnDiscussion&gt;Environment variables can be used to change the behavior of remote sessions and should be limited. Locale environment variables that specify the language, character set, and other features modifying the operation of software to match the user's preferences.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100243r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+AcceptEnv</fixtext><fix id="F-100243r1_fix" /><check system="C-93313r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^AcceptEnv" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "AcceptEnv", this is a finding.</check-content></check></Rule></Group><Group id="V-93997"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104083r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000025</version><title>The ESXi host SSH daemon must not permit tunnels.</title><description>&lt;VulnDiscussion&gt;OpenSSH has the ability to create network tunnels (layer-2 and layer-3) over an SSH connection. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100245r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+PermitTunnel no</fixtext><fix id="F-100245r1_fix" /><check system="C-93315r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitTunnel" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitTunnel no", this is a finding.</check-content></check></Rule></Group><Group id="V-93999"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104085r1_rule" severity="low" weight="10.0"><version>ESXI-65-000026</version><title>The ESXi host SSH daemon must set a timeout count on idle sessions.</title><description>&lt;VulnDiscussion&gt;This ensures a user login will be terminated as soon as the "ClientAliveCountMax" is reached.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100247r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+ClientAliveCountMax 3</fixtext><fix id="F-100247r1_fix" /><check system="C-93317r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveCountMax" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveCountMax 3", this is a finding.</check-content></check></Rule></Group><Group id="V-94001"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104087r1_rule" severity="low" weight="10.0"><version>ESXI-65-000027</version><title>The ESXi hostSSH daemon must set a timeout interval on idle sessions.</title><description>&lt;VulnDiscussion&gt;Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100249r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+ClientAliveInterval 200</fixtext><fix id="F-100249r1_fix" /><check system="C-93319r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveInterval" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveInterval 200", this is a finding.</check-content></check></Rule></Group><Group id="V-94003"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104089r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000028</version><title>The ESXi host SSH daemon must limit connections to a single session.</title><description>&lt;VulnDiscussion&gt;The SSH protocol has the ability to provide multiple sessions over a single connection without reauthentication. A compromised client could use this feature to establish additional sessions to a system without consent or knowledge of the user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100251r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":
+
+MaxSessions 1</fixtext><fix id="F-100251r1_fix" /><check system="C-93321r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MaxSessions" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MaxSessions 1", this is a finding.</check-content></check></Rule></Group><Group id="V-94005"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104091r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000029</version><title>The ESXi host must remove keys from the SSH authorized_keys file.</title><description>&lt;VulnDiscussion&gt;ESXi hosts come with SSH which can be enabled to allow remote access without requiring user authentication.  To enable password free access copy the remote users public key into the "/etc/ssh/keys-root/authorized_keys" file on the ESXi host.  The presence of the remote user's public key in the "authorized_keys" file identifies the user as trusted, meaning the user is granted access to the host without providing a password.  If using Lockdown Mode and SSH is disabled then login with authorized keys will have the same restrictions as username/password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100253r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, zero or remove the /etc/ssh/keys-root/authorized_keys file:
+
+# &gt;/etc/ssh/keys-root/authorized_keys
+
+or
+
+# rm /etc/ssh/keys-root/authorized_keys</fixtext><fix id="F-100253r1_fix" /><check system="C-93323r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# ls -la /etc/ssh/keys-root/authorized_keys
+
+or
+
+# cat /etc/ssh/keys-root/authorized_keys
+
+If the authorized_keys file exists and is not empty, this is a finding.</check-content></check></Rule></Group><Group id="V-94007"><title>SRG-OS-000037-VMM-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104093r1_rule" severity="low" weight="10.0"><version>ESXI-65-000030</version><title>The ESXi host must produce audit records containing information to establish what type of events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-100255r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.log.level value and configure it to "info".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level | Set-AdvancedSetting -Value "info"</fixtext><fix id="F-100255r1_fix" /><check system="C-93325r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.HostAgent.log.level value and verify it is set to "info".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level
+
+If the Config.HostAgent.log.level setting is not set to info, this is a finding.
+
+Note: Verbose logging level is acceptable for troubleshooting purposes.</check-content></check></Rule></Group><Group id="V-94009"><title>SRG-OS-000069-VMM-000360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104095r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000031</version><title>The ESXi host  must enforce password complexity by requiring that at least one upper-case character be used.</title><description>&lt;VulnDiscussion&gt;To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000192</ident><fixtext fixref="F-100257r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Security.PasswordQualityControl value and configure it to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.PasswordQualityControl | Set-AdvancedSetting -Value "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15"</fixtext><fix id="F-100257r1_fix" /><check system="C-93327r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Security.PasswordQualityControl value and verify it is set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15"
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.PasswordQualityControl
+
+If the Security.PasswordQualityControl setting is not set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15", this is a finding.</check-content></check></Rule></Group><Group id="V-94011"><title>SRG-OS-000077-VMM-000440</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104097r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000032</version><title>The ESXi host must prohibit the reuse of passwords within five iterations.</title><description>&lt;VulnDiscussion&gt;If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000200</ident><fixtext fixref="F-100259r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in “/etc/pam.d/passwd”:
+
+password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512 remember=5</fixtext><fix id="F-100259r1_fix" /><check system="C-93329r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If the remember setting is not set or is not "remember=5", this is a finding.</check-content></check></Rule></Group><Group id="V-94013"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104099r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000033</version><title>The password hashes stored on the ESXi host must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.</title><description>&lt;VulnDiscussion&gt;Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100261r1_fix">From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in “/etc/pam.d/passwd”:
+
+password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512 remember=5</fixtext><fix id="F-100261r1_fix" /><check system="C-93331r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If sha512 is not listed, this is a finding.</check-content></check></Rule></Group><Group id="V-94015"><title>SRG-OS-000095-VMM-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104101r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000034</version><title>The ESXi host must disable the Managed Object Browser (MOB).</title><description>&lt;VulnDiscussion&gt;The Managed Object Browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host and enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK, but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access.  By default this is disabled for ESXi in version 6.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-100263r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.solo.enableMob value and configure it to false.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob | Set-AdvancedSetting -Value false</fixtext><fix id="F-100263r1_fix" /><check system="C-93333r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Config.HostAgent.plugins.solo.enableMob value and verify it is set to false.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob
+
+If the Config.HostAgent.plugins.solo.enableMob setting is not set to false, this is a finding.</check-content></check></Rule></Group><Group id="V-94017"><title>SRG-OS-000095-VMM-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104103r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000035</version><title>The ESXi host must be configured to disable non-essential capabilities by disabling SSH.</title><description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides temporary access to commands essential for server maintenance. Intended primarily for use in break-fix scenarios, the ESXi shell is well suited for checking and modifying configuration details, not always generally accessible, using the vSphere Client. The ESXi shell is accessible remotely using SSH by users with the Administrator role. Under normal operating conditions, SSH access to the host must be disabled as is the default.  As with the ESXi shell, SSH is also intended only for temporary use during break-fix scenarios. SSH must therefore be disabled under normal operating conditions and must only be enabled for diagnostics or troubleshooting. Remote access to the host must therefore be limited to the vSphere Client at all other times.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-100265r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit then select the SSH service and click the Stop button to stop the service. Use the pull-down menu to change the Startup policy to "Start and stop manually" and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"} | Set-VMHostService -Policy Off
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"} | Stop-VMHostService</fixtext><fix id="F-100265r1_fix" /><check system="C-93335r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit and view the "SSH" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"}
+
+If the ESXi SSH service is running, this is a finding.</check-content></check></Rule></Group><Group id="V-94019"><title>SRG-OS-000095-VMM-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104105r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000036</version><title>The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.</title><description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-100267r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit then select the ESXi Shell service and click the Stop button to stop the service. Use the pull-down menu to change the Startup policy to "Start and stop manually" and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Set-VMHostService -Policy Off
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Stop-VMHostService</fixtext><fix id="F-100267r1_fix" /><check system="C-93337r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under Services select Edit and view the "ESXi Shell" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"}
+
+If the ESXi Shell service is running, this is a finding.</check-content></check></Rule></Group><Group id="V-94021"><title>SRG-OS-000104-VMM-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104107r1_rule" severity="low" weight="10.0"><version>ESXI-65-000037</version><title>The ESXi host must use Active Directory for local user authentication.</title><description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-100269r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services. Click Join Domain and enter the AD domain to join, select the "Using credentials” radio button and enter the credentials of an account with permissions to join machines to AD (use UPN naming – user@domain) and then click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain -Domain "domain name" -User "username" -Password "password"</fixtext><fix id="F-100269r1_fix" /><check system="C-93339r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services.  Verify the Directory Services Type is set to Active Directory.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the Directory Services Type is not set to "Active Directory", this is a finding.</check-content></check></Rule></Group><Group id="V-94023"><title>SRG-OS-000104-VMM-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104109r2_rule" severity="medium" weight="10.0"><version>ESXI-65-000038</version><title>The ESXi host must use the vSphere Authentication Proxy to protect passwords when adding ESXi hosts to Active Directory.</title><description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-100271r1_fix">From the vSphere Web Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Security and Services &gt;&gt; Security Settings &gt;&gt; Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; Join Domain Method. Set the method used to join hosts to a domain to "Use vSphere Authentication Proxy to add the host to domain" and provide the IP address of the vSphere Authentication Proxy server.</fixtext><fix id="F-100271r1_fix" /><check system="C-93341r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Security and Services &gt;&gt; Security Settings &gt;&gt; Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; Join Domain Method. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if JoinADEnabled is True then JoinDomainMethod should be "FixedCAMConfigOption".
+
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-94025"><title>SRG-OS-000104-VMM-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104111r1_rule" severity="low" weight="10.0"><version>ESXI-65-000039</version><title>Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.</title><description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-100273r1_fix">From the vSphere Web Client select the ESXi Host and go to Configuration &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.hostsvc.esxAdminsGroup value and configure it to an Active Directory group other than "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup | Set-AdvancedSetting -Value &lt;AD Group&gt;</fixtext><fix id="F-100273r1_fix" /><check system="C-93343r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configuration &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.hostsvc.esxAdminsGroup value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" keyword is set to "ESX Admins", this is a finding.</check-content></check></Rule></Group><Group id="V-94027"><title>SRG-OS-000107-VMM-000530</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104113r1_rule" severity="low" weight="10.0"><version>ESXI-65-000040</version><title>The ESXi host must use multifactor authentication for local access to privileged accounts.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000767</ident><fixtext fixref="F-100275r1_fix">The following are pre-requisites to configuration smart card authentication for the ESXi DCUI: 
+-Active Directory domain that supports smart card authentication, smart card readers, and smart cards. 
+-ESXi joined to an Active Directory domain. 
+-Trusted certificates for root and intermediary certificate authorities. 
+
+From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services and click Edit and check "Enable Smart Card Authentication" checkbox, at the Certificates tab, click the green plus sign to import trusted certificate authority certificates and click OK.</fixtext><fix id="F-100275r1_fix" /><check system="C-93345r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services and view the Smart Card Authentication status. If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.</check-content></check></Rule></Group><Group id="V-94029"><title>SRG-OS-000163-VMM-000700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104115r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000041</version><title>The ESXi host must set a timeout to automatically disable idle sessions after 10 minutes.</title><description>&lt;VulnDiscussion&gt;If a user forgets to log out of their SSH session, the idle connection will remains open indefinitely, increasing the potential for someone to gain privileged access to the host.  The ESXiShellInteractiveTimeOut allows you to automatically terminate idle shell sessions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001133</ident><fixtext fixref="F-100277r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the UserVars.ESXiShellInteractiveTimeOut value and configure it to 600.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut | Set-AdvancedSetting -Value 600</fixtext><fix id="F-100277r1_fix" /><check system="C-93347r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellInteractiveTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut
+
+If the UserVars.ESXiShellInteractiveTimeOut setting is not set to 600, this is a finding.</check-content></check></Rule></Group><Group id="V-94031"><title>SRG-OS-000163-VMM-000700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104117r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000042</version><title>The ESXi host must terminate shell services after 10 minutes.</title><description>&lt;VulnDiscussion&gt;When the ESXi Shell or SSH services are enabled on a host they will run indefinitely.  To avoid having these services left running set the ESXiShellTimeOut.  The ESXiShellTimeOut defines a window of time after which the ESXi Shell and SSH services will automatically be terminated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001133</ident><fixtext fixref="F-100279r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the UserVars.ESXiShellTimeOut value and configure it to 600.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut | Set-AdvancedSetting -Value 600</fixtext><fix id="F-100279r1_fix" /><check system="C-93349r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut
+
+If the UserVars.ESXiShellTimeOut setting is not set to 600, this is a finding.</check-content></check></Rule></Group><Group id="V-94033"><title>SRG-OS-000163-VMM-000700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104119r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000043</version><title>The ESXi host must logout of the console UI after 10 minutes.</title><description>&lt;VulnDiscussion&gt;When the Direct console user interface (DCUI) is enabled and logged in it should be automatically logged out if left logged in to avoid unauthorized privilege gains.  The DcuiTimeOut defines a window of time after which the DCUI will be logged out.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001133</ident><fixtext fixref="F-100281r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the UserVars.DcuiTimeOut value and configure it to 600.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut | Set-AdvancedSetting -Value 600</fixtext><fix id="F-100281r1_fix" /><check system="C-93351r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.DcuiTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut
+
+If the UserVars.DcuiTimeOut setting is not set to 600, this is a finding.</check-content></check></Rule></Group><Group id="V-94035"><title>SRG-OS-000269-VMM-000950</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104121r1_rule" severity="low" weight="10.0"><version>ESXI-65-000044</version><title>The ESXi host must enable kernel core dumps.</title><description>&lt;VulnDiscussion&gt;In the event of a system failure, the system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001665</ident><fixtext fixref="F-100283r1_fix">From the vSphere Web Client select the ESXi Host and right click. Select the "Add Diagnostic Partition" option configure a core dump diagnostic partition.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run at least one of the following sets of commands:
+
+To configure a core dump partition:
+
+$esxcli = Get-EsxCli
+#View available partitions to configure
+$esxcli.system.coredump.partition.list()
+$esxcli.system.coredump.partition.set($null,"PartitionName",$null,$null)
+
+To configure a core dump collector:
+
+$esxcli = Get-EsxCli
+$esxcli.system.coredump.network.set($null,"vmkernel port to use",$null,"CollectorIP","CollectorPort")
+$esxcli.system.coredump.network.set($true)</fixtext><fix id="F-100283r1_fix" /><check system="C-93353r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and right click.  If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.system.coredump.partition.get()
+$esxcli.system.coredump.network.get()
+
+The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables. 
+
+If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-94037"><title>SRG-OS-000341-VMM-001220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104123r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000045</version><title>The ESXi host must enable a persistent log location for all locally stored logs.</title><description>&lt;VulnDiscussion&gt;ESXi can be configured to store log files on an in-memory file system.  This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done only a single day's worth of logs are stored at any time. In addition log files will be reinitialized upon each reboot.  This presents a security risk as user activity logged on the host is only stored temporarily and will not persistent across reboots.  This can also complicate auditing and make it harder to monitor events and diagnose issues.  ESXi host logging should always be configured to a persistent datastore.
+
+Note: Scratch space is configured automatically during installation or first boot of an ESXi host, and does not usually need to be manually configured. ESXi Installable creates a 4 GB Fat16 partition on the target device during installation if there is sufficient space, and if the device is considered Local.  If ESXi is installed on an SD card or USB device a persistent log location may not be configured upon install as normal.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-100285r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Syslog.global.logDir value and set it to a known persistent location.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir | Set-AdvancedSetting -Value "New Log Location"</fixtext><fix id="F-100285r1_fix" /><check system="C-93355r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Syslog.global.logDir value and verify it is set to a persistent location.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir
+
+or
+
+$esxcli = Get-EsxCli
+$esxcli.system.syslog.config.get() | Select LocalLogOutput,LocalLogOutputIsPersistent
+
+If the Syslog.global.logDir or LocalLogOutput value is not on persistent storage, this is a finding.
+
+If the LocalLogOutputIsPersistent value is not true, this is a finding.</check-content></check></Rule></Group><Group id="V-94039"><title>SRG-OS-000355-VMM-001330</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104125r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000046</version><title>The ESXi host must configure NTP time synchronization.</title><description>&lt;VulnDiscussion&gt;To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001891</ident><fixtext fixref="F-100287r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to configure the NTP service to start and stop with the host and with authoritative DoD time sources.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+$NTPServers = "ntpserver1","ntpserver2"
+Get-VMHost | Add-VMHostNTPServer $NTPServers
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"} | Set-VMHostService -Policy On
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"} | Start-VMHostService</fixtext><fix id="F-100287r1_fix" /><check system="C-93357r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to verify the configured NTP servers and service startup policy.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostNTPServer
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"}
+
+If the NTP service is not configured with authoritative DoD time sources and the service is not configured to start and stop with the host and is running, this is a finding.</check-content></check></Rule></Group><Group id="V-94041"><title>SRG-OS-000366-VMM-001430</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104127r1_rule" severity="high" weight="10.0"><version>ESXI-65-000047</version><title>The ESXi Image Profile and VIB Acceptance Levels must be verified.</title><description>&lt;VulnDiscussion&gt;Verify the ESXi Image Profile to only allow signed VIBs.  An unsigned VIB represents untested code installed on an ESXi host.  The ESXi Image profile supports four acceptance levels: 
+
+(1) VMwareCertified - VIBs created, tested and signed by VMware
+(2) VMwareAccepted - VIBs created by a VMware partner but tested and signed by VMware, 
+(3) PartnerSupported - VIBs created, tested and signed by a certified VMware partner 
+(4) CommunitySupported - VIBs that have not been tested by VMware or a VMware partner.  
+
+Community Supported VIBs are not supported and do not have a digital signature.  To protect the security and integrity of your ESXi hosts do not allow unsigned (CommunitySupported) VIBs to be installed on your hosts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001749</ident><fixtext fixref="F-100289r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under "Host Image Profile Acceptance Level" click Edit… and use the pull-down selection, set the acceptance level to be VMwareCertified, VMwareAccepted, or PartnerSupported.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.software.acceptance.Set("PartnerSupported")
+
+Note: VMwareCertified or VMwareAccepted may be substituted for PartnerSupported, depending upon local requirements.</fixtext><fix id="F-100289r1_fix" /><check system="C-93359r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under "Host Image Profile Acceptance Level" view the acceptance level.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.software.acceptance.get()
+
+If the acceptance level is CommunitySupported, this is a finding.</check-content></check></Rule></Group><Group id="V-94043"><title>SRG-OS-000423-VMM-001700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104129r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000048</version><title>The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.</title><description>&lt;VulnDiscussion&gt;While encrypted vMotion is available now vMotion traffic should still be sequestered from other traffic to further protect it from attack. This network must be only be accessible to other ESXi hosts preventing outside access to the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-100291r1_fix">Configuration of the vMotion VMkernel will be unique to each environment. As an example, to modify the IP address and VLAN information to the correct network on a distributed switch do the following:
+
+From the vSphere Web Client go to Networking &gt;&gt; Select a distributed switch &gt;&gt; Select a port group &gt;&gt; Configure &gt;&gt; Settings &gt;&gt; Edit &gt;&gt; VLAN. Change the "VLAN Type" to "VLAN" and change the "VLAN ID" to a network allocated and dedicated to vMotion traffic exclusively.</fixtext><fix id="F-100291r1_fix" /><check system="C-93361r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>The vMotion VMKernel port group should in a dedicated VLAN that can be on a common standard or distributed virtual switch as long as the vMotion VLAN is not shared by any other function and it not routed to anything but ESXi hosts.  The check for this will be unique per environment.  From the vSphere Client select the ESXi host and go to Configuration &gt; Networking and review the VLAN associated with the vMotion VMkernel(s) and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If long distance or cross vCenter vMotion is used the vMotion network can be routable but must be accessible to only the intended ESXi hosts.
+
+If the vMotion port group is not on an isolated VLAN and/or is routable to systems other than ESXi hosts, this is a finding.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</check-content></check></Rule></Group><Group id="V-94047"><title>SRG-OS-000423-VMM-001700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104133r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000050</version><title>The ESXi host must protect the confidentiality and integrity of transmitted information by protecting IP based management traffic.</title><description>&lt;VulnDiscussion&gt;Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI and NFS. This configuration might expose IP-based storage traffic to unauthorized virtual machine users. IP-based storage frequently is not encrypted. It can be viewed by anyone with access to this network. To restrict unauthorized users from viewing the IP-based storage traffic, the IP-based storage network must be logically separated from the production traffic. Configuring the IP-based storage adaptors on separate VLANs or network segments from other VMkernels and Virtual Machines will limit unauthorized users from viewing the traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-100295r1_fix">Configuration of an IP-Based VMkernel will be unique to each environment but for example to modify the IP address and VLAN information to the correct network on a standard switch for an iSCSI VMkernel do the following:
+
+From the vSphere Web Client select the ESXi host and go to Configure &gt;&gt; Networking &gt;&gt; VMkernel adapters. Select the Storage VMkernel (for vSAN only) and click Edit settings &gt;&gt; On the Port properties tab uncheck everything but "vSAN.” On the IP Settings tab &gt;&gt; Enter the appropriate IP address and subnet information and click OK. 
+
+Set the appropriate VLAN ID &gt;&gt; Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Select the Storage portgroup (iSCSI, NFS, vSAN) and click Edit settings &gt;&gt; On the properties tab, enter the appropriate VLAN ID and click OK.</fixtext><fix id="F-100295r1_fix" /><check system="C-93365r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>IP-Based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a common standard or distributed virtual switch that is logically separated from other traffic types.  The check for this will be unique per environment.  
+
+From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; VMkernel adapters and review the VLANs associated with any IP-Based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If any IP-Based storage networks are not isolated from other traffic types, this is a finding.
+
+If IP-based storage is not used, this is not applicable.</check-content></check></Rule></Group><Group id="V-94051"><title>SRG-OS-000423-VMM-001700</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104137r1_rule" severity="low" weight="10.0"><version>ESXI-65-000052</version><title>The ESXi host must protect the confidentiality and integrity of transmitted information by utilizing different TCP/IP stacks where possible.</title><description>&lt;VulnDiscussion&gt;There are three different TCP/IP stacks by default available on ESXi now which are Default, Provisioning, and vMotion.  To better protect and isolate sensitive network traffic within ESXi admins must configure each of these stacks.  Additional custom TCP/IP stacks can be created if desired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-100299r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; TCP/IP configuration &gt;&gt; Select a TCP/IP stack &gt;&gt; Click Edit &gt;&gt; Enter the appropriate site specific IP address information for the particular TCP/IP stack and click OK.</fixtext><fix id="F-100299r1_fix" /><check system="C-93369r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; TCP/IP configuration. Review the default system TCP/IP stacks and verify they are configured with the appropriate IP address information.
+
+If vMotion and Provisioning VMKernels are in use and are not utilizing their own TCP/IP stack, this is a finding.</check-content></check></Rule></Group><Group id="V-94053"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104139r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000053</version><title>SNMP must be configured properly on the ESXi host.</title><description>&lt;VulnDiscussion&gt;If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100301r1_fix">To disable SNMP run the following command from a PowerCLI command prompt while connected to the ESXi Host:
+
+Get-VMHostSnmp | Set-VMHostSnmp -Enabled $false
+
+or
+
+From a console or ssh session run the follow command:
+
+esxcli system snmp set -e no
+
+To configure SNMP for v3 targets use the "esxcli system snmp set" command set.</fixtext><fix id="F-100301r1_fix" /><check system="C-93371r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostSnmp | Select *
+
+or
+
+From a console or ssh session run the follow command:
+
+esxcli system snmp get
+
+If SNMP is not in use and is enabled, this is a finding.
+
+If SNMP is enabled and read only communities is set to public, this is a finding.
+
+If SNMP is enabled and is not using v3 targets, this is a finding.
+
+Note: SNMP v3 targets can only be viewed and configured from the esxcli command.</check-content></check></Rule></Group><Group id="V-94055"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104141r1_rule" severity="low" weight="10.0"><version>ESXI-65-000054</version><title>The ESXi host must enable bidirectional CHAP authentication for iSCSI traffic.</title><description>&lt;VulnDiscussion&gt;When enabled, vSphere performs bidirectional authentication of both the iSCSI target and host. There is a potential for a MiTM attack, when not authenticating both the iSCSI target and host, in which an attacker might impersonate either side of the connection to steal data. Bidirectional authentication mitigates this risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100303r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Storage &gt;&gt; Storage Adapters &gt;&gt; Select the iSCSI adapter &gt;&gt; Properties &gt;&gt; Authentication and click the Edit button. Set Authentication method to “Use bidirectional CHAP” and enter a unique secret for each traffic flow direction.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostHba | Where {$_.Type -eq "iscsi"} | Set-VMHostHba -ChapType Required -ChapName "chapname" -ChapPassword "password" -MutualChapEnabled $true -MutualChapName "mutualchapname" -MutualChapPassword "mutualpassword"</fixtext><fix id="F-100303r1_fix" /><check system="C-93373r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Storage &gt;&gt; Storage Adapters &gt;&gt; Select the iSCSI adapter &gt;&gt; Properties &gt;&gt; Authentication method and view the CHAP configuration and verify CHAP is "Required" for target and host authentication.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostHba | Where {$_.Type -eq "iscsi"} | Select AuthenticationProperties -ExpandProperty AuthenticationProperties
+
+If iSCSI is not used, this is not a finding.
+
+If iSCSI is used and CHAP is not set to "Required" for both the target and host, this is a finding.
+
+If iSCSI is used and unique CHAP secrets are not used for each host, this is a finding.</check-content></check></Rule></Group><Group id="V-94057"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104143r1_rule" severity="low" weight="10.0"><version>ESXI-65-000055</version><title>The ESXi host must disable Inter-VM transparent page sharing.</title><description>&lt;VulnDiscussion&gt;Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try and determine an AES encryption key in use on another virtual machine running on the same physical processor of the host server if Transparent Page Sharing is enabled between the two virtual machines. This technique works only in a highly controlled system configured in a non-standard way that VMware believes would not be recreated in a production environment.
+
+Even though VMware believes information being disclosed in real world conditions is unrealistic, out of an abundance of caution upcoming ESXi Update releases will no longer enable TPS between Virtual Machines by default (TPS will still be utilized within individual VMs).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100305r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Mem.ShareForceSalting value and configure it to 2.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting | Set-AdvancedSetting -Value 2</fixtext><fix id="F-100305r1_fix" /><check system="C-93375r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Mem.ShareForceSalting value and verify it is set to 2.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting
+
+If the Mem.ShareForceSalting setting is not set to 2, this is a finding.</check-content></check></Rule></Group><Group id="V-94059"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104145r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000056</version><title>The ESXi host must configure the firewall to restrict access to services running on the host.</title><description>&lt;VulnDiscussion&gt;Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access. Reduce the risk by configuring the ESXi firewall to only allow access from authorized networks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100307r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under the Firewall section click Edit and for each enabled service uncheck the check box to “Allow connections from any IP address,” and input the site specific network(s) required.Configure this for Incoming and Outgoing connections.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+$esxcli = Get-EsxCli
+#This disables the allow all rule for the target service
+$esxcli.network.firewall.ruleset.set($false,$true,"sshServer")
+$esxcli.network.firewall.ruleset.allowedip.add("192.168.0.0/24","sshServer")
+
+This must be done for each enabled service.</fixtext><fix id="F-100307r1_fix" /><check system="C-93377r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under the Firewall section click Edit and for each enabled service click Firewall and review the allowed IPs. Check this for Incoming and Outgoing connections.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostFirewallException | Where {$_.Enabled -eq $true} | Select Name,Enabled,@{N="AllIPEnabled";E={$_.ExtensionData.AllowedHosts.AllIP}}
+
+If for an enabled service "Allow connections from any IP address" is selected, this is a finding.</check-content></check></Rule></Group><Group id="V-94061"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104147r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000057</version><title>The ESXi host must configure the firewall to block network traffic by default.</title><description>&lt;VulnDiscussion&gt;In addition to service specific firewall rules ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic.  Reduce the risk of attack by making sure this is set to deny incoming and outgoing traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100309r1_fix">From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostFirewallDefaultPolicy | Set-VMHostFirewallDefaultPolicy -AllowIncoming $false -AllowOutgoing $false</fixtext><fix id="F-100309r1_fix" /><check system="C-93379r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostFirewallDefaultPolicy
+
+If the Incoming or Outgoing policies are True, this is a finding.</check-content></check></Rule></Group><Group id="V-94063"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104149r1_rule" severity="low" weight="10.0"><version>ESXI-65-000058</version><title>The ESXi host must enable BPDU filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.</title><description>&lt;VulnDiscussion&gt;BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected to reduce the STP convergence delay. If a BPDU packet is sent from a virtual machine on the ESXi host to the physical switch so configured, a cascading lockout of all the uplink interfaces from the ESXi host can occur. To prevent this type of lockout, BPDU Filter can be enabled on the ESXi host to drop any BPDU packets being sent to the physical switch. The caveat is that certain SSL VPN which use Windows bridging capability can legitimately generate BPDU packets. The administrator should verify that there are no legitimate BPDU packets generated by virtual machines on the ESXi host prior to enabling BPDU Filter.  If BPDU Filter is enabled in this situation, enabling Reject Forged Transmits on the virtual switch port group adds protection against Spanning Tree loops.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100311r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Net.BlockGuestBPDU value and configure it to 1.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU | Set-AdvancedSetting -Value 1</fixtext><fix id="F-100311r1_fix" /><check system="C-93381r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.BlockGuestBPDU value and verify it is set to 1.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU
+
+If the Net.BlockGuestBPDU setting is not set to 1, this is a finding.</check-content></check></Rule></Group><Group id="V-94065"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104151r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000059</version><title>The virtual switch Forged Transmits policy must be set to reject on the ESXi host.</title><description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated source MAC address at any time. This allows an operating system to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. 
+ 
+This means the virtual switch does not compare the source and effective MAC addresses. 
+ 
+To protect against MAC address impersonation, all virtual switches should have forged transmissions set to Reject. Reject Forged Transmit can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100313r1_fix">From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. For each virtual switch and port group click Edit settings and change "Forged Transmits" to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -ForgedTransmits $false
+Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -ForgedTransmitsInherited $true</fixtext><fix id="F-100313r1_fix" /><check system="C-93383r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Forged Transmits" policy is set to accept, this is a finding.</check-content></check></Rule></Group><Group id="V-94067"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104153r1_rule" severity="high" weight="10.0"><version>ESXI-65-000060</version><title>The virtual switch MAC Address Change policy must be set to reject on the ESXi host.</title><description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. Reject MAC Changes can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100315r1_fix">From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. For each virtual switch and port group click Edit settings and change "MAC Address Changes" to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -MacChanges $false
+Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -MacChangesInherited $true</fixtext><fix id="F-100315r1_fix" /><check system="C-93385r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "MAC Address Changes" policy is set to accept, this is a finding.</check-content></check></Rule></Group><Group id="V-94069"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104155r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000061</version><title>The virtual switch Promiscuous Mode policy must be set to reject on the ESXi host.</title><description>&lt;VulnDiscussion&gt;When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that Portgroup. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting. Promiscous mode can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100317r1_fix">From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. For each virtual switch and port group click Edit settings and change "Promiscuous Mode" to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy | Set-SecurityPolicy -AllowPromiscuous $false
+Get-VirtualPortGroup | Get-SecurityPolicy | Set-SecurityPolicy -AllowPromiscuousInherited $true</fixtext><fix id="F-100317r1_fix" /><check system="C-93387r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Promiscuous Mode" policy is set to accept, this is a finding.</check-content></check></Rule></Group><Group id="V-94071"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104157r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000062</version><title>The ESXi host must prevent unintended use of the dvFilter network APIs.</title><description>&lt;VulnDiscussion&gt;If you are not using products that make use of the dvfilter network API, the host should not be configured to send network information to a VM. If the API is enabled an attacker might attempt to connect a VM to it thereby potentially providing access to the network of other VMs on the host. If you are using a product that makes use of this API then verify that the host has been configured correctly. If you are not using such a product make sure the setting is blank.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100319r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Net.DVFilterBindIpAddress value and remove any incorrect addresses.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.DVFilterBindIpAddress | Set-AdvancedSetting -Value ""</fixtext><fix id="F-100319r1_fix" /><check system="C-93389r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.DVFilterBindIpAddress value and verify the value is blank or the correct IP address of a security appliance if in use.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.DVFilterBindIpAddress
+
+If the Net.DVFilterBindIpAddress is not blank and security appliances are not in use on the host, this is a finding.</check-content></check></Rule></Group><Group id="V-94073"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104159r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000063</version><title>For the ESXi host all port groups must be configured to a value other than that of the native VLAN.</title><description>&lt;VulnDiscussion&gt;ESXi does not use the concept of native VLAN. Frames with VLAN specified in the port group will have a tag, but frames with VLAN not specified in the port group are not tagged and therefore will end up as belonging to native VLAN of the physical switch. For example, frames on VLAN 1 from a Cisco physical switch will be untagged, because this is considered as the native VLAN. However, frames from ESXi specified as VLAN 1 will be tagged with a "1"; therefore, traffic from ESXi that is destined for the native VLAN will not be correctly routed (because it is tagged with a "1" instead of being untagged), and traffic from the physical switch coming from the native VLAN will not be visible (because it is not tagged). If the ESXi virtual switch port group uses the native VLAN ID, traffic from those VMs will not be visible to the native VLAN on the switch, because the switch is expecting untagged traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100321r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Highlight a port group (where VLAN ID set to native VLAN ID) and click Edit settings. Change the VLAN ID to a non-native VLAN and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup -Name "portgroup name" | Set-VirtualPortGroup -VLanId "New VLAN#"</fixtext><fix id="F-100321r1_fix" /><check system="C-93391r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to the native VLAN ID of the attached physical switch.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with the native VLAN of the ESXi hosts attached physical switch, this is a finding.</check-content></check></Rule></Group><Group id="V-94075"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104161r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000064</version><title>For the ESXi host all port groups must not be configured to VLAN 4095 unless Virtual Guest Tagging (VGT) is required.</title><description>&lt;VulnDiscussion&gt;When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes all network frames to the guest VM without modifying the VLAN tags, leaving it up to the guest to deal with them. VLAN 4095 should be used only if the guest has been specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it might cause denial-of-service or allow a guest VM to interact with traffic on an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100323r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Highlight a port group (where VLAN ID set to 4095) and click Edit settings. Change the VLAN ID to not be 4095 and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup -Name "portgroup name" | Set-VirtualPortGroup -VLanId "New VLAN#"</fixtext><fix id="F-100323r1_fix" /><check system="C-93393r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to 4095.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanID
+
+If any port group is configured with VLAN 4095 and is not documented as a needed exception, this is a finding.</check-content></check></Rule></Group><Group id="V-94077"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104163r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000065</version><title>For the ESXi host all port groups must not be configured to VLAN values reserved by upstream physical switches.</title><description>&lt;VulnDiscussion&gt;Certain physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001–1024 and 4094, while Nexus switches typically reserve 3968–4047 and 4094. Check with the documentation for your specific switch. Using a reserved VLAN might result in a denial of service on the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100325r1_fix">From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. Highlight a port group (where VLAN ID set to 4095) and click Edit settings (pencil). Change the VLAN ID to not be a reserved VLAN ID and click OK.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup -Name "portgroup name" | Set-VirtualPortGroup -VLanId "New VLAN#"</fixtext><fix id="F-100325r1_fix" /><check system="C-93395r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to a reserved VLAN ID.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with a reserved VLAN ID, this is a finding.</check-content></check></Rule></Group><Group id="V-94079"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104165r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000066</version><title>For physical switch ports connected to the ESXi host, the non-negotiate option must be configured for trunk links between external physical switches and virtual switches in VST mode.</title><description>&lt;VulnDiscussion&gt;In order to communicate with virtual switches in VST mode, external switch ports must be configured as trunk ports. VST mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. The auto or desirable physical switch settings do not work with the ESXi Server because the physical switch communicates with the ESXi Server using DTP. The non-negotiate and on options unconditionally enable VLAN trunking on the physical switch and create a VLAN trunk link between the ESXi Server and the physical switch. The difference between non-negotiate and on options is that on mode still sends out DTP frames, whereas the non-negotiate option does not.  The non-negotiate option should be used for all VLAN trunks, to minimize unnecessary network traffic for virtual switches in VST mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100327r1_fix">Note that this check refers to an entity outside the physical scope of the ESXi server system. Document the configuration of external switch ports as trunk ports. Log in to the vendor-specific physical switch and disable DTP on the physical switch ports connected to the ESXi Host. Update the documentation on an organization defined frequency or whenever modifications are made to either ESXi hosts or the upstream external switch ports.</fixtext><fix id="F-100327r1_fix" /><check system="C-93397r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of external switch ports as trunk ports must be documented. Virtual Switch Tagging (VST) mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. Inspect the documentation and verify that the documentation is correct and updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream external switch ports.
+
+If DTP is enabled on the physical switch ports connected to the ESXi Host, this is a finding.</check-content></check></Rule></Group><Group id="V-94081"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104167r1_rule" severity="low" weight="10.0"><version>ESXI-65-000067</version><title>All ESXi host-connected physical switch ports must be configured with spanning tree disabled.</title><description>&lt;VulnDiscussion&gt;Since VMware virtual switches do not support STP, the ESXi host-connected physical switch ports must have portfast configured if spanning tree is enabled to avoid loops within the physical switch network. If these are not set, potential performance and connectivity issues might arise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100329r1_fix">Note that this check refers to an entity outside the scope of the ESXi server system. Document the upstream physical switch configuration for spanning tree protocol disablement and/or portfast configuration for all physical ports connected to ESXi hosts. Log in to the physical switch(es) and disable spanning tree protocol and/or configure portfast for all physical ports connected to ESXi hosts. Update the documentation on an organization defined frequency or whenever modifications are made to either ESXi hosts or the upstream physical switches.</fixtext><fix id="F-100329r1_fix" /><check system="C-93399r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's spanning tree protocol is not disabled or portfast is not configured for all physical ports connected to ESXi hosts, this is a finding.</check-content></check></Rule></Group><Group id="V-94083"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104169r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000068</version><title>All ESXi host-connected virtual switch VLANs must be fully documented and have only the required VLANs.</title><description>&lt;VulnDiscussion&gt;When defining a physical switch port for trunk mode, only specified VLANs must be configured on the VLAN trunk link. The risk with not fully documenting all VLANs on the vSwitch is that it is possible that a physical trunk port might be configured without needed VLANs, or with unneeded VLANs, potentially enabling an administrator to either accidentally or maliciously connect a VM to an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100331r1_fix">Note that this check refers to an entity outside the scope of the ESXi server system.
+
+Remove any VLANs trunked across physical ports connected to ESXi hosts that are not in use.</fixtext><fix id="F-100331r1_fix" /><check system="C-93401r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that unneeded VLANs are configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that only needed VLANs are configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's configuration is trunked VLANs that are not used by ESXi for all physical ports connected to ESXi hosts, this is a finding.</check-content></check></Rule></Group><Group id="V-94349"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104303r2_rule" severity="medium" weight="10.0"><version>ESXI-65-000070</version><title>The ESXi host must not provide root/administrator level access to CIM-based hardware monitoring tools or other third-party applications.</title><description>&lt;VulnDiscussion&gt;The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server.  Place this user in the Exception Users list.  When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100465r2_fix">Create a role for the CIM account.
+
+From the Host Client, go to manage, then Security &amp; Users. Select Roles then click Add Role. Provide a name for the new role then select Host &gt;&gt; Cim &gt;&gt; Ciminteraction and click Add.
+
+Add a CIM user account.
+
+From the Host Client, go to manage, then Security &amp; Users. Select Users then click Add User. Provide a name, description, and password for the new user then click Add.
+
+Assign the CIM account permissions to the host with the new role.
+
+From the Host Client, select the ESXi host, right click and go to "Permissions". Click Add User and select the CIM account from the drop down list and select the new CIM role from the drop down list and click Add User.</fixtext><fix id="F-100465r2_fix" /><check system="C-93535r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server. Place this user in the Exception Users list. When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.
+
+From the Host Client, select the ESXi host, right click and go to "Permissions". Verify the CIM account user role is limited to read only and CIM permissions.
+
+If there is no dedicated CIM account and the root is used for CIM monitoring, this is a finding.
+
+If write access is not required and the access level is not "read-only", this is a finding.</check-content></check></Rule></Group><Group id="V-94477"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104307r1_rule" severity="high" weight="10.0"><version>ESXI-65-000071</version><title>The ESXi host must verify the integrity of the installation media before installing ESXi.</title><description>&lt;VulnDiscussion&gt;Always check the SHA1 or MD5 hash after downloading an ISO, offline bundle, or patch to ensure integrity and authenticity of the downloaded files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100593r1_fix">If the hash returned from the md5sum or sha1sum commands do not match the vendor's hash, the downloaded software must be discarded. 
+
+If the physical media is obtained from VMware and the security seal is broken, the software must be returned to VMware for replacement.</fixtext><fix id="F-100593r1_fix" /><check system="C-93601r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>The downloaded ISO, offline bundle, or patch hash must be verified against the vendor's checksum to ensure the integrity and authenticity of the files. 
+
+See some typical command line example(s) for both the md5 and sha1 hash check(s) directly below.
+
+# md5sum &lt;filename&gt;.iso
+# sha1sum &lt;filename&gt;.iso
+
+If any of the system's downloaded ISO, offline bundle, or system patch hashes cannot be verified against the vendor's checksum, this is a finding.</check-content></check></Rule></Group><Group id="V-94479"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104309r1_rule" severity="high" weight="10.0"><version>ESXI-65-000072</version><title>The ESXi host must have all security patches and updates installed.</title><description>&lt;VulnDiscussion&gt;Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100595r1_fix">If vCenter Update Manager is used on the network, hosts can be remediated from the vSphere Web Client. From the vSphere Web Client go to Hosts and Clusters &gt;&gt; Update Manager tab and select a non-compliant host and click the Remediate button.
+
+To manually remediate a host the patch file must be copied locally and the following command run from an SSH session connected to the ESXi host, or from the ESXi shell:
+
+esxcli software vib update -d &lt;path to offline patch bundle.zip&gt;</fixtext><fix id="F-100595r1_fix" /><check system="C-93665r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>If vCenter Update Manager is used on the network it can be used to scan all hosts for missing patches.  From the vSphere Client go to Hosts and Clusters &gt; Update Manager tab and select scan to view all hosts compliance status.
+
+If vCenter Update Manager is not used a hosts compliance status must be manually determined by the build number.  The following VMware KB 1014508 can be used to correlate patches with build numbers.
+
+If the ESXi host does not have the latest patches, this is a finding.
+
+If the ESXi host is not on a supported release, this is a finding.
+
+VMware also publishes Advisories on security patches, and offers a way to subscribe to email alerts for them.
+https://www.vmware.com/support/policies/security_response</check-content></check></Rule></Group><Group id="V-94481"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104311r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000073</version><title>The ESXi host must enable TLS 1.2 exclusively for the SFCB service.</title><description>&lt;VulnDiscussion&gt;TLS 1.0 and 1.1 are deprecated protocols with well published shortcomings and vulnerabilities. TLS 1.2 should be enabled on all interfaces and SSLv3, TL 1.1 and 1.0 disabled where supported. Mandating TLS 1.2 may break third party integrations and add-ons to vSphere. Test these integrations carefully after implementing TLS 1.2 and roll back where appropriate. On interfaces where required functionality is broken with TLS 1.2 this finding is N/A until such time as the third party software supports TLS 1.2.
+
+Make sure you modify TLS settings in the following order: 1. Platform Services Controllers (if applicable), 2. vCenter, 3. ESXi&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100597r1_fix">Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+
+cp -f /etc/sfcb/sfcb.cfg /etc/sfcb/sfcb.cfg.orig
+
+grep -v "enableTLS" /etc/sfcb/sfcb.cfg.orig&gt;/etc/sfcb/sfcb.cfg
+
+echo enableTLSv1: false&gt;&gt;sfcb.cfg
+
+echo enableTLSv1_1: false&gt;&gt;sfcb.cfg
+
+echo enableTLSv1_2: true&gt;&gt;sfcb.cfg
+
+/etc/init.d/sfcbd-watchdog  restart</fixtext><fix id="F-100597r1_fix" /><check system="C-93667r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+grep "enableTLS" /etc/sfcb/sfcb.cfg
+
+If the output indicates that any protocol is enabled other than TLSv1_2, this is a finding.</check-content></check></Rule></Group><Group id="V-94483"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104313r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000074</version><title>The ESXi host must exclusively enable TLS 1.2 for the ioFilter, vSANVP and reverse proxy services.</title><description>&lt;VulnDiscussion&gt;TLS 1.0 and 1.1 are deprecated protocols with well published shortcomings and vulnerabilities. TLS 1.2 should be enabled on all interfaces and SSLv3, TL 1.1 and 1.0 disabled where supported. Mandating TLS 1.2 may break third party integrations and add-ons to vSphere. Test these integrations carefully after implementing TLS 1.2 and roll back where appropriate. On interfaces where required functionality is broken with TLS 1.2 this finding is N/A until such time as the third party software supports TLS 1.2.
+
+Make sure you modify TLS settings in the following order: 1. Platform Services Controllers (if applicable), 2. vCenter, 3. ESXi&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100599r1_fix">From the vSphere Web Client, select the host and then click Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Find the UserVars.ESXiVPsDisabledProtocols value and set to the following:
+
+tlsv1,tlsv1.1,sslv3
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiVPsDisabledProtocols | Set-AdvancedSetting -Value "tlsv1,tlsv1.1,sslv3"
+
+A host reboot is required for changes to take effect.</fixtext><fix id="F-100599r1_fix" /><check system="C-93669r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>From the vSphere Web Client, select the host and then click Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Find the UserVars.ESXiVPsDisabledProtocols value and verify that it is set to the following:
+
+tlsv1,tlsv1.1,sslv3
+
+If the value is not set as above or it does not exist, this is a finding.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiVPsDisabledProtocols
+
+If the value returned is not "tlsv1,tlsv1.1,sslv3" or the setting does not exist, this is a finding.</check-content></check></Rule></Group><Group id="V-94487"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104317r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000076</version><title>The ESXi host must enable Secure Boot.</title><description>&lt;VulnDiscussion&gt;Secure Boot is a protocol of UEFI firmware that ensures the integrity of the boot process from hardware up through to the OS. Secure Boot for ESXi requires support from the firmware and it requires that all ESXi kernel modules, drivers, and VIBs be signed by VMware or a partner subordinate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100603r2_fix">Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -c
+
+If the output indicates that Secure Boot cannot be enabled, correct the discrepancies and try again. If the discrepancies cannot be rectified this finding is downgraded to a CAT III.
+
+Consult your vendor documentation and boot the host into BIOS setup mode. Enable UEFI boot mode and Secure Boot. Restart the host.
+
+Temporarily enable SSH, connect to the ESXi host and run the following command to verify that Secure Boot is enabled:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -s</fixtext><fix id="F-100603r2_fix" /><check system="C-93673r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -s
+
+If the output is not Enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-94489"><title>SRG-OS-000480-VMM-002000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104319r1_rule" severity="medium" weight="10.0"><version>ESXI-65-000078</version><title>The ESXi host must use DoD-approved certificates.</title><description>&lt;VulnDiscussion&gt;The default self-signed, VMCA issued host certificate must be replaced with a DoD-approved certificate. The use of a DoD certificate on the host assures clients that the service they are connecting to is legitimate and properly secured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-100605r2_fix">Obtain a DoD issued certificate and private key for the host following the below requirements:
+
+Key size: 2048 bits or more (PEM encoded)
+Key format: PEM. VMware supports PKCS8 and PKCS1 (RSA keys)
+x509 version 3
+SubjectAltName must contain DNS Name=&lt;machine_FQDN&gt;
+CRT (Base-64) format
+Contains the following Key Usages: Digital Signature, Non Repudiation, Key Encipherment
+Start time of one day before the current time
+CN (and SubjectAltName) set to the host name (or IP address) that the ESXi host has in the vCenter Server inventory.
+
+Put the host into maintenance mode.
+
+Temporarily enable SSH on the host. SCP the new certificate and key to /tmp. SSH to the host. Back up the existing certificate and key:
+
+mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.bak
+mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.bak
+
+Copy your new certificate and key to /etc/vmware/ssl/ and rename them to rui.crt and rui.key respectively. Restart management agents to implement the new certificate:
+
+services.sh restart
+
+From the vSphere Web Client go to vCenter Inventory Lists &gt;&gt; vCenter Servers &gt;&gt; Select your vCenter Server &gt;&gt; Manage &gt;&gt; Settings &gt;&gt; Advanced Settings. Find or create the vpxd.certmgmt.mode key and set its value to custom.</fixtext><fix id="F-100605r2_fix" /><check system="C-93675r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+# openssl x509 -in /etc/vmware/ssl/rui.crt -text | grep Issuer
+
+If the issuer is not a DoD approved certificate authority, this is a finding.</check-content></check></Rule></Group><Group id="V-94505"><title>SRG-OS-000109-VMM-000550</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104335r2_rule" severity="low" weight="10.0"><version>ESXI-65-100037</version><title>The ESXi host must require individuals to be authenticated with an individual authenticator prior to using a group authenticator by using Active Directory for local user authentication.</title><description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000770</ident><fixtext fixref="F-100621r1_fix">From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services.  Click "Properties" and change the "Directory Service Type" to "Active Directory", enter the domain to join, check "Use vSphere Authentication Proxy" and enter the proxy server address then click "Join Domain".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain -Domain "domain name" -User "username" -Password "password"</fixtext><fix id="F-100621r1_fix" /><check system="C-93693r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser"", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-94507"><title>SRG-OS-000109-VMM-000550</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104337r2_rule" severity="medium" weight="10.0"><version>ESXI-65-100038</version><title>The ESXi host must require individuals to be authenticated with an individual authenticator prior to using a group authenticator by using the vSphere Authentication Proxy.</title><description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000770</ident><fixtext fixref="F-100623r1_fix">When using host profiles do the following:
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles and select a Host Profile to edit.  View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomain Method.  Set the method used to join hosts to a domain to "Use vSphere Authentication Proxy to add the host to domain" and provide the IP address of the vSphere Authentication Proxy server.
+
+To join a host to Active Directory manually without host profiles do the following:
+
+From the vSphere Client select the ESXi Host and go to Configuration &gt;&gt; Authentication Services.  Click Properties and change the "Directory Service Type" to Active Directory, enter the domain to join, check "Use vSphere Authentication Proxy" and enter the proxy server address then click "Join Domain".</fixtext><fix id="F-100623r1_fix" /><check system="C-93695r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles and select a Host Profile to edit. View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomain Method. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if JoinADEnabled is True then JoinDomainMethod should be "FixedCAMConfigOption".
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If vSphere Authentication Proxy is not used to join hosts to an Active Directory domain, this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-94509"><title>SRG-OS-000109-VMM-000550</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104339r1_rule" severity="low" weight="10.0"><version>ESXI-65-100039</version><title>The ESXi host must require individuals to be authenticated with an individual authenticator prior to using a group authenticator by restricting use of Active Directory ESX Admin group membership.</title><description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000770</ident><fixtext fixref="F-100625r1_fix">From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and configure it to an Active Directory group other than "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup | Set-AdvancedSetting -Value &lt;AD Group&gt;</fixtext><fix id="F-100625r1_fix" /><check system="C-93697r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value is set to "ESX Admins", this is a finding.</check-content></check></Rule></Group><Group id="V-94511"><title>SRG-OS-000376-VMM-001520</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104341r1_rule" severity="low" weight="10.0"><version>ESXI-65-100040</version><title>The ESXi host must accept Personal Identity Verification (PIV) credentials.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001953</ident><fixtext fixref="F-100627r1_fix">The following are pre-requisites to configuration smart card authentication for the ESXi DCUI:
+-Active Directory domain that supports smart card authentication, smart card readers, and smart cards.
+-ESXi joined to an Active Directory domain.
+-Trusted certificates for root and intermediary certificate authorities.
+
+From the vSphere Web Client select the ESXi Host and go to Manage &gt;&gt; Authentication Services and edit the Smart Card Authentication configuration to add trusted certificate authority certificates and select "Enable Smart Card Authentication" and click "OK".
+
+For more information see the vSphere 6.5 documentation on VMware's website.</fixtext><fix id="F-100627r1_fix" /><check system="C-93699r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and view the "Enable Smart Card Authentication" status.
+
+If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.</check-content></check></Rule></Group><Group id="V-94529"><title>SRG-OS-000112-VMM-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104359r2_rule" severity="low" weight="10.0"><version>ESXI-65-200037</version><title>The ESXi host must implement replay-resistant authentication mechanisms for network access to privileged accounts by using Active Directory for local user authentication.</title><description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001941</ident><fixtext fixref="F-100645r1_fix">From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services.  Click "Properties" and change the "Directory Service Type" to "Active Directory", enter the domain to join, check "Use vSphere Authentication Proxy" and enter the proxy server address then click "Join Domain".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain -Domain "domain name" -User "username" -Password "password"</fixtext><fix id="F-100645r1_fix" /><check system="C-93717r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-94531"><title>SRG-OS-000112-VMM-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104361r2_rule" severity="medium" weight="10.0"><version>ESXI-65-200038</version><title>The ESXi host must implement replay-resistant authentication mechanisms for network access to privileged accounts by using the vSphere Authentication Proxy.</title><description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001941</ident><fixtext fixref="F-100647r1_fix">When using host profiles do the following:
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit.  View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomainMethod.  Set the method used to join hosts to a domain to "Use vSphere Authentication Proxy to add the host to domain" and provide the IP address of the vSphere Authentication Proxy server.
+
+To join a host to Active Directory manually without host profiles do the following:
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services.  Click "Properties" and change the "Directory Service Type" to "Active Directory", enter the domain to join, check "Use vSphere Authentication Proxy" and enter the proxy server address then click "Join Domain".</fixtext><fix id="F-100647r1_fix" /><check system="C-93719r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles and select a Host Profile to edit. View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomainMethod. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if "JoinADEnabled" is "True" then "JoinDomainMethod" should be "FixedCAMConfigOption".
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If vSphere Authentication Proxy is not used to join hosts to an Active Directory domain, this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.
+</check-content></check></Rule></Group><Group id="V-94533"><title>SRG-OS-000112-VMM-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104363r1_rule" severity="low" weight="10.0"><version>ESXI-65-200039</version><title>The ESXi host must implement replay-resistant authentication mechanisms for network access to privileged accounts by restricting use of Active Directory ESX Admin group membership.</title><description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001941</ident><fixtext fixref="F-100649r1_fix">From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and configure it to an Active Directory group other than "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup | Set-AdvancedSetting -Value &lt;AD Group&gt;</fixtext><fix id="F-100649r1_fix" /><check system="C-93721r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and verify it is NOT set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value is set to "ESX Admins", this is a finding.</check-content></check></Rule></Group><Group id="V-94535"><title>SRG-OS-000377-VMM-001530</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104365r1_rule" severity="low" weight="10.0"><version>ESXI-65-200040</version><title>The ESXi host must electronically verify Personal Identity Verification (PIV) credentials.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001954</ident><fixtext fixref="F-100651r1_fix">The following are pre-requisites to configuration smart card authentication for the ESXi DCUI:
+-Active Directory domain that supports smart card authentication, smart card readers, and smart cards.
+-ESXi joined to an Active Directory domain.
+-Trusted certificates for root and intermediary certificate authorities.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and edit the Smart Card Authentication configuration to add trusted certificate authority certificates and select "Enable Smart Card Authentication" and click "OK".
+
+For more information see the vSphere 6.5 documentation on VMware's website.</fixtext><fix id="F-100651r1_fix" /><check system="C-93723r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and view the Smart Card Authentication status.
+
+If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.</check-content></check></Rule></Group><Group id="V-94543"><title>SRG-OS-000113-VMM-000570</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104373r2_rule" severity="low" weight="10.0"><version>ESXI-65-300037</version><title>The ESXi host must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using Active Directory for local user authentication.</title><description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001942</ident><fixtext fixref="F-100659r1_fix">From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services.  Click "Properties" and change the "Directory Service Type" to "Active Directory", enter the domain to join, check "Use vSphere Authentication Proxy" and enter the proxy server address then click "Join Domain".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication | Set-VMHostAuthentication -JoinDomain -Domain "domain name" -User "username" -Password "password"</fixtext><fix id="F-100659r1_fix" /><check system="C-93731r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-94545"><title>SRG-OS-000113-VMM-000570</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104375r2_rule" severity="medium" weight="10.0"><version>ESXI-65-300038</version><title>The ESXi host must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using the vSphere Authentication Proxy.</title><description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001942</ident><fixtext fixref="F-100661r1_fix">When using host profiles do the following:
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit.  View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomainMethod.  Set the method used to join hosts to a domain to "Use vSphere Authentication Proxy to add the host to domain" and provide the IP address of the vSphere Authentication Proxy server.
+
+To join a host to Active Directory manually without host profiles do the following:
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services.  Click "Properties" and change the "Directory Service Type" to "Active Directory", enter the domain to join, check "Use vSphere Authentication Proxy" and enter the proxy server address then click "Join Domain".</fixtext><fix id="F-100661r1_fix" /><check system="C-93733r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomainMethod. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if "JoinADEnabled" is "True" then "JoinDomainMethod" should be "FixedCAMConfigOption".
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If vSphere Authentication Proxy is not used to join hosts to an Active Directory domain, this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</check-content></check></Rule></Group><Group id="V-94547"><title>SRG-OS-000113-VMM-000570</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104377r1_rule" severity="low" weight="10.0"><version>ESXI-65-300039</version><title>The ESXi host must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by restricting use of Active Directory ESX Admin group membership.</title><description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001942</ident><fixtext fixref="F-100663r1_fix">From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and configure it to an Active Directory group other than "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup | Set-AdvancedSetting -Value &lt;AD Group&gt;</fixtext><fix id="F-100663r1_fix" /><check system="C-93735r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value is set to "ESX Admins", this is a finding.</check-content></check></Rule></Group><Group id="V-94549"><title>SRG-OS-000403-VMM-001640</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104379r1_rule" severity="low" weight="10.0"><version>ESXI-65-300040</version><title>The ESXi host must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target ESXi 6.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>ESXi 6.5</dc:subject><dc:identifier>3485</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-100665r1_fix">The following are pre-requisites to configuration smart card authentication for the ESXi DCUI:
+-Active Directory domain that supports smart card authentication, smart card readers, and smart cards.
+-ESXi joined to an Active Directory domain.
+-Trusted certificates for root and intermediary certificate authorities.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and edit the Smart Card Authentication configuration to add trusted certificate authority certificates and select "Enable Smart Card Authentication" and click "OK".
+
+For more information see the vSphere 6.5 documentation on VMware's website.</fixtext><fix id="F-100665r1_fix" /><check system="C-93737r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_VMware_vSphere_6-5_ESXi_STIG.xml" /><check-content>For systems that have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and view the Smart Card Authentication status.
+
+If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R1_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R1_Manual-xccdf.log
new file mode 100644
index 000000000..bd41f3634
--- /dev/null
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R1_Manual-xccdf.log	
@@ -0,0 +1,3 @@
+V-100115::This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files::If an account associated with roles other than auditors
+V-100177::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'; ValueData = 0; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}
+V-100163::CREATOR OWNER: Full Control, Subfolders and files only::CREATOR OWNER: Full Control - Subfolders and files only
diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R1_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R1_Manual-xccdf.xml
new file mode 100644
index 000000000..26dedbaa8
--- /dev/null
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R1_Manual-xccdf.xml	
@@ -0,0 +1,919 @@
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="IIS_10-0_Server_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-24">accepted</status><title>Microsoft IIS 10.0 Server Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 1 Benchmark Date: 20 Mar 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100103" selected="true" /><select idref="V-100105" selected="true" /><select idref="V-100107" selected="true" /><select idref="V-100109" selected="true" /><select idref="V-100111" selected="true" /><select idref="V-100113" selected="true" /><select idref="V-100115" selected="true" /><select idref="V-100117" selected="true" /><select idref="V-100119" selected="true" /><select idref="V-100121" selected="true" /><select idref="V-100123" selected="true" /><select idref="V-100125" selected="true" /><select idref="V-100127" selected="true" /><select idref="V-100129" selected="true" /><select idref="V-100131" selected="true" /><select idref="V-100133" selected="true" /><select idref="V-100135" selected="true" /><select idref="V-100137" selected="true" /><select idref="V-100139" selected="true" /><select idref="V-100141" selected="true" /><select idref="V-100143" selected="true" /><select idref="V-100145" selected="true" /><select idref="V-100147" selected="true" /><select idref="V-100149" selected="true" /><select idref="V-100151" selected="true" /><select idref="V-100153" selected="true" /><select idref="V-100155" selected="true" /><select idref="V-100157" selected="true" /><select idref="V-100159" selected="true" /><select idref="V-100161" selected="true" /><select idref="V-100163" selected="true" /><select idref="V-100165" selected="true" /><select idref="V-100167" selected="true" /><select idref="V-100169" selected="true" /><select idref="V-100171" selected="true" /><select idref="V-100173" selected="true" /><select idref="V-100175" selected="true" /><select idref="V-100177" selected="true" /><select idref="V-100179" selected="true" /><select idref="V-100181" selected="true" /><select idref="V-100183" selected="true" /><select idref="V-100185" selected="true" /><select idref="V-100187" selected="true" /><select idref="V-100189" selected="true" /></Profile><Group id="V-100103"><title>SRG-APP-000015-WSR-000014</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109207r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000100</version><title>The IIS 10.0 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.</title><description>&lt;VulnDiscussion&gt;Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.
+
+An alternative to remote administration of the web server is to perform web server administration locally at the console. Local administration at the console implies physical access to the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001453</ident><fixtext fixref="F-105789r1_fix">Ensure the web server administration is only performed over a secure path.</fixtext><fix id="F-105789r1_fix" /><check system="C-98955r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>If web administration is performed at the console, this check is NA.
+
+If web administration is performed remotely the following checks will apply:
+
+If administration of the server is performed remotely, it will only be performed securely by system administrators.
+
+If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO.
+
+Remote administration must be in compliance with any requirements contained within the Windows Server STIGs, and any applicable Network STIGs.
+
+Remote administration of any kind will be restricted to documented and authorized personnel.
+
+All users performing remote administration must be authenticated.
+
+All remote sessions will be encrypted and utilize FIPS 140-2-approved protocols.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater.
+
+Review with site management how remote administration is configured on the website, if applicable.
+
+If remote management meets the criteria listed above, this is not a finding.
+
+If remote management is utilized and does not meet the criteria listed above, this is a finding.</check-content></check></Rule></Group><Group id="V-100105"><title>SRG-APP-000092-WSR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109209r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000102</version><title>The enhanced logging for the IIS 10.0 web server must be enabled and capture all user and web server events.</title><description>&lt;VulnDiscussion&gt;Log files are a critical component to the successful management of an IS used within the DoD. By generating log files with useful information, web administrators can leverage them in the event of a disaster, malicious attack, or other site specific needs.
+
+Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety.
+
+Without sufficient information establishing when the log event occurred, investigation into the cause of event is severely hindered. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000097-WSR-000059&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><ident system="http://iase.disa.mil/cci">CCI-000131</ident><ident system="http://iase.disa.mil/cci">CCI-000132</ident><ident system="http://iase.disa.mil/cci">CCI-000133</ident><ident system="http://iase.disa.mil/cci">CCI-001462</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><fixtext fixref="F-105791r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Click the "Logging" icon.
+
+Under Format select "W3C".
+
+Select the following fields: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
+
+Under the "Actions" pane, click "Apply".</fixtext><fix id="F-105791r1_fix" /><check system="C-98957r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Click the "Logging" icon.
+
+Under Format select "W3C".
+
+Click "Select Fields", verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
+
+If not, this is a finding.</check-content></check></Rule></Group><Group id="V-100107"><title>SRG-APP-000092-WSR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109211r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000103</version><title>Both the log file and Event Tracing for Windows (ETW) for the IIS 10.0 web server must be enabled.</title><description>&lt;VulnDiscussion&gt;Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.
+
+In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000139</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><ident system="http://iase.disa.mil/cci">CCI-001851</ident><fixtext fixref="F-105793r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 server name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, select the "Both log file and ETW event" radio button.
+
+Under the "Actions" pane, click "Apply".</fixtext><fix id="F-105793r1_fix" /><check system="C-98959r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 server name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.
+
+If the "Both log file and ETW event" radio button is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100109"><title>SRG-APP-000098-WSR-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109213r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000109</version><title>An IIS 10.0 web server behind a load balancer or proxy server must produce log records containing the source client IP and destination information.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the correct source (e.g., source IP), of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the loggable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.
+
+A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000133</ident><fixtext fixref="F-105795r1_fix">Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 10.0 web server transparently.</fixtext><fix id="F-105795r1_fix" /><check system="C-98961r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy.
+
+If the IIS 10.0 web server is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.
+
+Follow this procedure for web server and each website:
+
+Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Click the "Logging" icon.
+
+Click on "View log files" under the "Actions" pane.
+
+When the log file is displayed, review source IP information in log entries and verify the entries do not reflect the IP address of the proxy server.
+
+If the website is not behind a load balancer or proxy server, this is Not Applicable.
+
+If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
+
+If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</check-content></check></Rule></Group><Group id="V-100111"><title>SRG-APP-000099-WSR-000061</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109215r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000110</version><title>The IIS 10.0 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 web server events.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.
+
+Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000134</ident><fixtext fixref="F-105797r1_fix">Access the IIS 10.0 web server IIS Manager.
+Click the IIS 10.0 web server name.
+Under "IIS", double-click the "Logging" icon.
+Verify the "Format:" under "Log File" is configured to "W3C".
+Select the "Fields" button.
+Under "Custom Fields", click the "Add Field..." button.
+For each field being added, give a name unique to what the field is capturing.
+Click on the "Source Type" drop-down list and select "Request Header".
+Click on the "Source" drop-down list and select "Connection".
+Click "OK" to add.
+
+Click on the "Source Type" drop-down list and select "Request Header".
+Click on the "Source" drop-down list and select "Warning".
+Click "OK" to add.
+Click "Apply" under the "Actions" pane.</fixtext><fix id="F-105797r1_fix" /><check system="C-98963r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 web server IIS Manager.
+Click the IIS 10.0 web server name.
+Under "IIS", double-click the "Logging" icon.
+Verify the "Format:" under "Log File" is configured to "W3C".
+Select the "Fields" button.
+Under "Custom Fields", verify the following fields have been configured:
+Request Header &gt;&gt; Connection
+Request Header &gt;&gt; Warning
+If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100113"><title>SRG-APP-000100-WSR-000064</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109217r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000111</version><title>The IIS 10.0 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
+
+Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001487</ident><fixtext fixref="F-105799r1_fix">Access the IIS 10.0 web server IIS Manager.
+Click the IIS 10.0 web server name.
+Under "IIS", double-click the "Logging" icon.
+Verify the "Format:" under "Log File" is configured to "W3C".
+Select the "Fields" button.
+Under "Standard Fields", select "User Agent", "User Name", and "Referrer".
+Under "Custom Fields", select the following fields:
+Click on the "Source Type" drop-down list and select "Request Header".
+Click on the "Source" drop-down list and select "Authorization".
+Click "OK" to add.
+
+Click on the "Source" drop-down list and select "Content-Type".
+Click on the "Source Type" drop-down list and select "Response Header".
+Click "OK" to add.
+Click "OK".
+Click "Apply" under the "Actions" pane.</fixtext><fix id="F-105799r1_fix" /><check system="C-98965r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 web server IIS Manager.
+Click the IIS 10.0 web server name.
+Under "IIS", double-click the "Logging" icon.
+Verify the "Format:" under "Log File" is configured to "W3C".
+Select the "Fields" button.
+Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected.
+Under "Custom Fields", verify the following field has been configured:
+Request Header &gt;&gt; Authorization
+Response Header &gt;&gt; Content-Type
+If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100115"><title>SRG-APP-000120-WSR-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109219r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000115</version><title>The log information from the IIS 10.0 web server must be protected from unauthorized modification or deletion.</title><description>&lt;VulnDiscussion&gt;A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the System Administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.
+
+Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000164</ident><fixtext fixref="F-105801r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Click the "Logging" icon.
+
+Click "Browse" and navigate to the directory where the log files are stored.
+
+Right-click the log file name to review and click "Properties".
+
+Click the "Security" tab.
+
+Set the log file permissions for the appropriate group(s).
+
+Click "OK".
+
+Select "Apply" in the "Actions" pane.</fixtext><fix id="F-105801r1_fix" /><check system="C-98967r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
+Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Click the "Logging" icon.
+Click "Browse" and navigate to the directory where the log files are stored.
+Right-click the log file name to review.
+Click "Properties".
+Click the "Security" tab.
+Verify log file access is restricted as follows. Otherwise, this is a finding.
+SYSTEM - Full Control
+Administrators - Full Control</check-content></check></Rule></Group><Group id="V-100117"><title>SRG-APP-000125-WSR-000071</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109221r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000116</version><title>The log data and records from the IIS 10.0 web server must be backed up onto a different system or media.</title><description>&lt;VulnDiscussion&gt;Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system, or onto separate media than the system on which the web server is running, helps to ensure the log records will be retained in the event of a catastrophic system failure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001348</ident><fixtext fixref="F-105803r1_fix">Configure system backups to include the directory paths of all IIS 10.0 web server and website log files.</fixtext><fix id="F-105803r1_fix" /><check system="C-98969r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>The IIS 10.0 web server and website log files should be backed up by the system backup.
+
+To determine if log files are backed up by the system backup, determine the location of the web server log files and each website's log files.
+
+Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 server name.
+
+Click the "Logging" icon.
+
+Under "Log File" &gt;&gt; "Directory" obtain the path of the log file.
+
+Once all locations are known, consult with the System Administrator to review the server's backup procedure and policy.
+
+Verify the paths of all log files are part of the system backup.
+Verify log files are backed up to an unrelated system or onto separate media on which the system the web server is running.
+
+If the paths of all log files are not part of the system backup and/or not backed up to a separate media, this is a finding.</check-content></check></Rule></Group><Group id="V-100119"><title>SRG-APP-000141-WSR-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109223r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000117</version><title>The IIS 10.0 web server must not perform user management for hosted applications.</title><description>&lt;VulnDiscussion&gt;User management and authentication can be an essential part of any application hosted by the web server. Along with authenticating users, the user management function must perform several other tasks enterprise-wide, such as password complexity, locking users after a configurable number of failed logons, and management of temporary and emergency accounts.
+
+The web server contains a minimal user management function, but the web server user management function does not offer enterprise-wide user management, and user management is not the primary function of the web server. User management for the hosted applications should be done through a facility built for enterprise-wide user management, such as LDAP and Active Directory.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105805r1_fix">Reconfigure any hosted applications on the IIS 10.0 web server to perform user management outside the IIS 10.0 web server.
+
+Document how the hosted application user management is accomplished.</fixtext><fix id="F-105805r1_fix" /><check system="C-98971r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Interview the System Administrator about the role of the IIS 10.0 web server.
+
+If the IIS 10.0 web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server.
+
+If the IIS 10.0 web server is not hosting an application, this is Not Applicable.
+
+If the IIS web server is performing user management for hosted applications, this is a finding.
+
+If the IIS 10.0 web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server, this is a finding.</check-content></check></Rule></Group><Group id="V-100121"><title>SRG-APP-000141-WSR-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109225r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000118</version><title>The IIS 10.0 web server must only contain functions necessary for operation.</title><description>&lt;VulnDiscussion&gt;A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to run on a production DoD system.
+
+The web server must provide the capability to disable, uninstall, or deactivate functionality and services deemed non-essential to the web server mission or that adversely impact server performance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105807r1_fix">Remove all unapproved programs and roles from the production IIS 10.0 web server.</fixtext><fix id="F-105807r1_fix" /><check system="C-98973r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Click “Start”.
+
+Open Control Panel.
+
+Click “Programs”.
+
+Click “Programs and Features”.
+
+Review the installed programs. If any programs are installed other than those required for the IIS 10.0 web services, this is a finding.
+
+Note: If additional software is needed, supporting documentation must be signed by the ISSO.</check-content></check></Rule></Group><Group id="V-100123"><title>SRG-APP-000141-WSR-000076</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109227r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000119</version><title>The IIS 10.0 web server must not be both a website server and a proxy server.</title><description>&lt;VulnDiscussion&gt;A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that also proxy requests into an otherwise protected network is a common attack, making the attack anonymous.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105809r1_fix">Open the IIS 10.0 Manager.
+
+Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server.
+
+Under the IIS installed features, "Application Request Routing Cache" is present, double-click the icon to open the feature.
+
+From the right "Actions" pane, under "Proxy", select "Server Proxy Settings...".
+
+In the "Application Request Routing" settings window, remove the check from the "Enable proxy" check box.
+
+Click "Apply" in the "Actions" pane.</fixtext><fix id="F-105809r1_fix" /><check system="C-98975r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server.
+
+If, under the IIS installed features, "Application Request Routing Cache" is not present, this is not a finding.
+
+If, under the IIS installed features, "Application Request Routing Cache" is present, double-click the icon to open the feature.
+
+From the right "Actions" pane, under "Proxy", select "Server Proxy Settings...".
+
+In the "Application Request Routing" settings window, verify whether "Enable proxy" is selected.
+
+If “Enable proxy" is selected under the "Application Request Routing" settings, this is a finding.</check-content></check></Rule></Group><Group id="V-100125"><title>SRG-APP-000141-WSR-000077</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109229r1_rule" severity="high" weight="10.0"><version>IIST-SV-000120</version><title>All IIS 10.0 web server sample code, example applications, and tutorials must be removed from a production IIS 10.0 server.</title><description>&lt;VulnDiscussion&gt;Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105811r1_fix">Remove any executable sample code, example applications, or tutorials which are not explicitly used by a production website.</fixtext><fix id="F-105811r1_fix" /><check system="C-98977r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Navigate to the following folders:
+
+inetpub\
+Program Files\Common Files\System\msadc
+Program Files (x86)\Common Files\System\msadc
+
+If the folder or sub-folders contain any executable sample code, example applications, or tutorials which are not explicitly used by a production website, this is a finding.</check-content></check></Rule></Group><Group id="V-100127"><title>SRG-APP-000141-WSR-000078</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109231r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000121</version><title>The accounts created by uninstalled features (i.e., tools, utilities, specific, etc.) must be deleted from the IIS 10.0 server.</title><description>&lt;VulnDiscussion&gt;Accounts used for web server features such as documentation, sample code, example applications, tutorials, utilities, and services created when the feature is not installed, become an exploitable threat to a web server.
+
+These accounts become inactive, are not monitored through regular use, and passwords for the accounts are not created or updated. An attacker, through very little effort, can use these accounts to gain access to the web server and begin investigating ways to elevate the account privileges.
+
+The accounts used for web server features not installed must not be created and must be deleted when these features are uninstalled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105813r1_fix">Access the IIS 10.0 web server.
+
+Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”.
+
+In the left pane, expand "Local Users and Groups" and click "Users".
+
+Delete any local accounts which were created by features which have been uninstalled or are not used.</fixtext><fix id="F-105813r1_fix" /><check system="C-98979r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 web server.
+
+Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”.
+
+In the left pane, expand "Local Users and Groups" and click "Users".
+
+Review the local users listed in the middle pane.
+
+If any local accounts are present and were created by features which have been uninstalled or are not used, this is a finding.</check-content></check></Rule></Group><Group id="V-100129"><title>SRG-APP-000141-WSR-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109233r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000123</version><title>The IIS 10.0 web server must be reviewed on a regular basis to remove any Operating System features, utility programs, plug-ins, and modules not necessary for operation.</title><description>&lt;VulnDiscussion&gt;Just as running unneeded services and protocols is a danger to the web server at the lower levels of the OSI model, running unneeded utilities and programs is a danger at the application layer of the OSI model. Office suites, development tools, and graphic editors are examples of such troublesome programs.
+
+Individual productivity tools have no legitimate place or use on an enterprise production web server and are prone to security risks. The web server installation process must provide options allowing the installer to choose which utility programs, services, and modules are to be installed or removed. By having a process for installation and removal, the web server is guaranteed to be in a more stable and secure state than if these services and programs were installed and removed manually.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105815r1_fix">Remove all utility programs, Operating System features, or modules installed that are not necessary for web server operation.</fixtext><fix id="F-105815r1_fix" /><check system="C-98981r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Consult with the System Administrator and review all of the IIS 10.0 and Operating System features installed.
+
+Determine if any features installed are no longer necessary for operation.
+
+If any utility programs, features, or modules are installed which are not necessary for operation, this is a finding.
+
+If any unnecessary Operating System features are installed, this is a finding.</check-content></check></Rule></Group><Group id="V-100131"><title>SRG-APP-000141-WSR-000081</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109235r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000124</version><title>The IIS 10.0 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.</title><description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
+
+A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105817r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under IIS, double-click the "MIME Types" icon.
+
+From the "Group by:" drop-down list, select "Content Type".
+
+From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions:
+
+.exe
+.dll
+.com
+.bat
+.csh
+
+Under the "Actions" pane, click "Apply".</fixtext><fix id="F-105817r1_fix" /><check system="C-98983r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under IIS, double-click the "MIME Types" icon.
+
+From the "Group by:" drop-down list, select "Content Type".
+
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+
+.exe
+.dll
+.com
+.bat
+.csh
+
+If any OS shell MIME types are configured, this is a finding.</check-content></check></Rule></Group><Group id="V-100133"><title>SRG-APP-000141-WSR-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109237r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000125</version><title>The IIS 10.0 web server must have Web Distributed Authoring and Versioning (WebDAV) disabled.</title><description>&lt;VulnDiscussion&gt;A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol which, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.
+
+WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105819r1_fix">Access Server Manager on the IIS 10.0 web server.
+
+Click the IIS 10.0 web server name.
+
+Click on "Manage".
+
+Select "Add Roles and Features".
+
+Click "Next" in the "Before you begin" dialog box.
+
+Select "Role-based or feature-based installation" on the "Installation Type" dialog box and click "Next".
+
+Select the IIS 10.0 web server in the "Server Selection" dialog box.
+
+From the "Windows Features" dialog box, navigate to "World Wide Web Services" &gt;&gt; "Common HTTP Features".
+
+De-select "WebDAV Publishing", and click "Next" to complete removing the WebDAV Publishing feature from the IIS 10.0 web server.</fixtext><fix id="F-105819r1_fix" /><check system="C-98985r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Review the features listed under the “IIS" section.
+
+If the "WebDAV Authoring Rules" icon exists, this is a finding.</check-content></check></Rule></Group><Group id="V-100135"><title>SRG-APP-000175-WSR-000095</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109239r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000129</version><title>The IIS 10.0 web server must perform RFC 5280-compliant certification path validation.</title><description>&lt;VulnDiscussion&gt;This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid, and therefore; the entire purpose of using a certificate is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000185</ident><fixtext fixref="F-105821r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Server Certificate" icon.
+
+Import a valid DoD certificate and remove any non-DoD certificates.</fixtext><fix id="F-105821r1_fix" /><check system="C-98987r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Server Certificate" icon.
+
+Double-click each certificate and verify the certificate path is to a DoD root CA.
+
+If the “Issued By” field of the PKI certificate being used by the IIS 10.0 server/site does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.</check-content></check></Rule></Group><Group id="V-100137"><title>SRG-APP-000206-WSR-000128</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109241r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000130</version><title>Java software installed on a production IIS 10.0 web server must be limited to .class files and the Java Virtual Machine.</title><description>&lt;VulnDiscussion&gt;Mobile code in hosted applications allows the developer to add functionality and displays to hosted applications that are fluid, as opposed to a static web page. The data presentation becomes more appealing to the user, is easier to analyze, and is less complicated to navigate through the hosted application and data.
+
+Some mobile code technologies in use in today's applications are: Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. The DoD has created policies that define the usage of mobile code on DoD systems. The usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on organizational servers and mobile code downloaded and executed on individual workstations.
+
+Source code for a Java program is often stored in files with either .java or .jpp file extensions. From the .java and .jpp files the Java compiler produces a binary file with an extension of .class. The .java or .jpp file could therefore reveal sensitive information regarding an application's logic and permissions to resources on the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001166</ident><fixtext fixref="F-105823r1_fix">Remove all files from the web server with both .java and .jpp extensions.</fixtext><fix id="F-105823r1_fix" /><check system="C-98989r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Search the system for files with either .java or .jpp extensions.
+
+If files with .java or .jpp extensions are found, this is a finding.</check-content></check></Rule></Group><Group id="V-100139"><title>SRG-APP-000211-WSR-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109243r1_rule" severity="high" weight="10.0"><version>IIST-SV-000131</version><title>IIS 10.0 Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.</title><description>&lt;VulnDiscussion&gt;As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001082</ident><fixtext fixref="F-105825r1_fix">Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities.
+
+All non-administrator access to shell scripts and operating system functions must be mission essential and documented.</fixtext><fix id="F-105825r1_fix" /><check system="C-98991r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Obtain a list of the user accounts with access to the system, including all local and domain accounts.
+
+Review the privileges to the web server for each account.
+
+Verify with the system administrator or the ISSO that all privileged accounts are mission essential and documented.
+
+Verify with the system administrator or the ISSO that all non-administrator access to shell scripts and operating system functions are mission essential and documented.
+
+If undocumented privileged accounts are found, this is a finding.
+
+If undocumented non-administrator access to shell scripts and operating system functions are found, this is a finding.
+
+If this IIS 10 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</check-content></check></Rule></Group><Group id="V-100141"><title>SRG-APP-000211-WSR-000129</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109245r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000132</version><title>The IIS 10.0 web server must separate the hosted applications from hosted web server management functionality.</title><description>&lt;VulnDiscussion&gt;The separation of user functionality from web server management can be accomplished by moving management functions to a separate IP address or port. To further separate the management functions, separate authentication methods and certificates should be used.
+
+By moving the management functionality, the possibility of accidental discovery of the management functions by non-privileged users during hosted application use is minimized.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001082</ident><fixtext fixref="F-105827r1_fix">Develop a method to manage the hosted applications, either by moving its management functions off of the IIS 10.0 web server or by accessing the application's management via a uniquely assigned IP address.</fixtext><fix id="F-105827r1_fix" /><check system="C-98993r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Review the IIS 10.0 web server configuration with the System Administrator.
+
+Determine if the IIS 10.0 web server hosts any applications.
+
+If the IIS 10.0 web server does not host any applications, this is Not Applicable.
+
+If the IIS 10.0 web server hosts applications, review the application's management functionality and authentication methods with the System Administrator to determine if the management of the application is accomplished with the same functions and authentication methods as the web server management.
+
+If the IIS 10.0 web server management and the application's management functionality is not separated, this is a finding.</check-content></check></Rule></Group><Group id="V-100143"><title>SRG-APP-000223-WSR-000011</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109247r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000134</version><title>The IIS 10.0 web server must use cookies to track session state.</title><description>&lt;VulnDiscussion&gt;Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol.
+
+Using URI will embed the session ID as a query string in the Uniform Resource Identifier (URI) request and then the URI is redirected to the originally requested URL. The changed URI request is used for the duration of the session, so no cookie is necessary.
+
+By requiring expired session IDs to be regenerated while using URI, potential attackers have less time to capture a cookie and gain access to the Web server content.
+
+Satisfies: SRG-APP-000223-WSR-000011, SRG-APP-000220-WSR-000201&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001664</ident><fixtext fixref="F-105829r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "ASP.Net", double-click the "Session State" icon.
+
+Under "Cookie Settings", select "Use Cookies” from the "Mode" drop-down list.
+
+Click "Apply" in the "Actions" pane.</fixtext><fix id="F-105829r1_fix" /><check system="C-98995r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under "ASP.Net", double-click the "Session State" icon.
+Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.
+If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding.
+
+Alternative method:
+
+Click the site name.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+Verify the "cookieless" is set to "UseCookies".
+If the "cookieless" is not set to "UseCookies", this is a finding.
+
+Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</check-content></check></Rule></Group><Group id="V-100145"><title>SRG-APP-000223-WSR-000145</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109249r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000135</version><title>The IIS 10.0 web server must accept only system-generated session identifiers.</title><description>&lt;VulnDiscussion&gt;ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session.
+
+When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001664</ident><fixtext fixref="F-105831r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Cookie Settings", select the "Use Cookies" mode from the "Mode:" drop-down list.
+
+Under “Time-out (in minutes), enter a value of “20 or less”.</fixtext><fix id="F-105831r1_fix" /><check system="C-98997r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under the "ASP.NET" section, select "Session State".
+Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.
+Under Time-out (in minutes), verify “20 minutes or less” is selected.
+If the "Use Cookies” mode is selected and Time-out (in minutes) is configured for “20 minutes or less”, this is not a finding.
+
+Alternative method:
+
+Click the site name.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+Verify the "cookieless" is set to "UseCookies".
+If the "cookieless" is not set to "UseCookies", this is a finding.
+
+Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</check-content></check></Rule></Group><Group id="V-100147"><title>SRG-APP-000225-WSR-000074</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109251r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000136</version><title>The IIS 10.0 web server must augment re-creation to a stable and known baseline.</title><description>&lt;VulnDiscussion&gt;Making certain that the web server has not been updated by an unauthorized user is always a concern. Adding patches, functions, and modules that are untested and not part of the baseline opens the possibility for security risks. The web server must offer, and not hinder, a method that allows for the quick and easy reinstallation of a verified and patched baseline to guarantee the production web server is up-to-date and has not been modified to add functionality or expose security risks.
+
+When the web server does not offer a method to roll back to a clean baseline, external methods, such as a baseline snapshot or virtualizing the web server, can be used.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001190</ident><fixtext fixref="F-105833r1_fix">Prepare documentation for disaster recovery methods for the IIS 10.0 web server in the event of the necessity for rollback.
+
+Document and test the disaster recovery methods designed.</fixtext><fix id="F-105833r1_fix" /><check system="C-98999r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Interview the System Administrator for the IIS 10.0 web server.
+
+Ask for documentation on the disaster recovery methods tested and planned for the IIS 10.0 web server in the event of the necessity for rollback.
+
+If documentation for a disaster recovery has not been established, this is a finding.</check-content></check></Rule></Group><Group id="V-100149"><title>SRG-APP-000231-WSR-000144</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109253r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000137</version><title>The production IIS 10.0 web server must utilize SHA2 encryption for the Machine Key.</title><description>&lt;VulnDiscussion&gt;The Machine Key element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. The Machine Key feature can be managed to specify hashing and encryption settings for application services such as view state, forms authentication, membership and roles, and anonymous identification. Ensuring a strong encryption method can mitigate the risk of data tampering in crucial functional areas such as forms authentication cookies, or view state.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><fixtext fixref="F-105835r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Machine Key" icon in the web server Home Pane.
+
+Set the Validation method to "HMACSHA256" or stronger.
+Set the Encryption method to "Auto".
+
+Click "Apply" in the "Actions" pane.</fixtext><fix id="F-105835r1_fix" /><check system="C-99001r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Machine Key" icon in the website Home Pane.
+
+Verify "HMACSHA256" or stronger encryption is selected for the Validation method and "Auto" is selected for the Encryption method.
+
+If "HMACSHA256" or stronger encryption is not selected for the Validation method and/or "Auto" is not selected for the Encryption method, this is a finding.
+
+If .NET is not installed, this is Not Applicable.</check-content></check></Rule></Group><Group id="V-100151"><title>SRG-APP-000251-WSR-000157</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109255r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000138</version><title>Directory Browsing on the IIS 10.0 web server must be disabled.</title><description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled, the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001310</ident><fixtext fixref="F-105837r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Directory Browsing" icon.
+
+Under the "Actions" pane click "Disabled".
+
+Under the "Actions" pane, click "Apply".</fixtext><fix id="F-105837r1_fix" /><check system="C-99003r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Directory Browsing" icon.
+
+Under the “Actions” pane verify "Directory Browsing" is disabled.
+
+If “Directory Browsing” is not disabled, this is a finding.</check-content></check></Rule></Group><Group id="V-100153"><title>SRG-APP-000266-WSR-000142</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109257r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000139</version><title>The IIS 10.0 web server indexing must only index web content.</title><description>&lt;VulnDiscussion&gt;The indexing service can be used to facilitate a search function for websites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-105839r1_fix">Run MMC.
+
+Add the Indexing Service snap-in.
+
+Edit the indexed directories to only include web document directories.</fixtext><fix id="F-105839r1_fix" /><check system="C-99005r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\.
+
+If this key exists, then indexing is enabled.
+
+If the key does not exist, this check is Not Applicable.
+
+Review the Catalog keys to determine if directories other than web document directories are being indexed.
+
+If so, this is a finding.</check-content></check></Rule></Group><Group id="V-100155"><title>SRG-APP-000266-WSR-000159</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109259r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000140</version><title>Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 web server, patches, loaded modules, and directory paths.</title><description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-105841r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Error Pages" icon.
+
+Click any error message, and then click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.
+
+Set Feature Setting to “Detailed errors for local requests and custom error pages for remote requests”.</fixtext><fix id="F-105841r1_fix" /><check system="C-99007r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Error Pages" icon.
+
+Click any error message, and then click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.
+
+If the feature setting is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</check-content></check></Rule></Group><Group id="V-100157"><title>SRG-APP-000315-WSR-000003</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109261r1_rule" severity="high" weight="10.0"><version>IIST-SV-000141</version><title>Remote access to the IIS 10.0 web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.</title><description>&lt;VulnDiscussion&gt;Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002314</ident><fixtext fixref="F-105843r1_fix">Ensure the web server administration is only performed over a secure path.</fixtext><fix id="F-105843r1_fix" /><check system="C-99009r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>If web administration is performed at the console, this check is Not Applicable.
+
+If web administration is performed remotely the following checks will apply.
+
+If administration of the server is performed remotely, it will only be performed securely by system administrators.
+
+If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO.
+
+Remote administration must be in compliance with any requirements contained within the Windows Server STIGs, and any applicable network STIGs.
+
+Remote administration of any kind will be restricted to documented and authorized personnel.
+
+All users performing remote administration must be authenticated.
+
+All remote sessions will be encrypted and utilize FIPS 140-2-approved protocols.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater.
+
+Review with site management how remote administration, if applicable, is configured on the website.
+
+If remote management meets the criteria listed above, this is not a finding.
+
+If remote management is utilized and does not meet the criteria listed above, this is a finding.</check-content></check></Rule></Group><Group id="V-100159"><title>SRG-APP-000315-WSR-000004</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109263r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000142</version><title>The IIS 10.0 web server must restrict inbound connections from non-secure zones.</title><description>&lt;VulnDiscussion&gt;Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform management functions.
+
+A web server can be accessed remotely and must be capable of restricting access from what the DoD defines as non-secure zones. Non-secure zones are defined as any IP, subnet, or region defined as a threat to the organization. The non-secure zones must be defined for public web servers logically located in a DMZ, as well as private web servers with perimeter protection devices. By restricting access from non-secure zones through internal web server access lists, the web server can stop or slow denial of service (DoS) attacks on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002314</ident><fixtext fixref="F-105845r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "Management", double-click "Management Service".
+
+Stop the Web Management Service under the "Actions" pane.
+
+Configure only known, secure IP ranges as "Allow".
+
+Select "Apply" in "Actions" pane.
+
+Restart the Web Management Service under the "Actions" pane.</fixtext><fix id="F-105845r1_fix" /><check system="C-99011r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Note: This requirement applies to the Web Management Service. If the Web Management Service is not installed, this is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "Management", double-click "Management Service".
+
+If "Enable remote connections" is not selected, this is Not Applicable.
+
+If "Enable remote connections" is selected, review the entries under "IP Address Restrictions".
+
+Verify only known, secure IP ranges are configured as "Allow".
+
+If "IP Address Restrictions" are not configured or IP ranges configured to "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.</check-content></check></Rule></Group><Group id="V-100161"><title>SRG-APP-000316-WSR-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109265r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000143</version><title>The IIS 10.0 web server must provide the capability to immediately disconnect or disable remote access to the hosted applications.</title><description>&lt;VulnDiscussion&gt;During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.
+
+The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.
+
+The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002322</ident><fixtext fixref="F-105847r1_fix">Prepare documented procedures for shutting down an IIS 10.0 website in the event of an attack.
+
+The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 10.0 web server IIS Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS Manager.
+
+In the "Actions" pane, under "Manage Server", click "Stop".</fixtext><fix id="F-105847r1_fix" /><check system="C-99013r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Interview the System Administrator and Web Manager.
+
+Ask for documentation for the IIS 10.0 web server administration.
+
+Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 10.0 web server IIS Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS Manager.
+
+In the "Actions" pane, under "Manage Server", click "Stop".
+
+If the web server is not capable or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.</check-content></check></Rule></Group><Group id="V-100163"><title>SRG-APP-000340-WSR-000029</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109267r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000144</version><title>IIS 10.0 web server system files must conform to minimum file permission requirements.</title><description>&lt;VulnDiscussion&gt;This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002235</ident><fixtext fixref="F-105849r1_fix">Open Explorer and navigate to the inetpub directory.
+
+Right-click "inetpub" and select "Properties".
+
+Click the "Security" tab.
+
+Set the following permissions:
+
+SYSTEM: Full control
+Administrators: Full control
+TrustedInstaller: Full control
+ALL APPLICATION PACKAGES (built-in security group): Read and execute
+Users: Read and execute, list folder contents
+CREATOR OWNER: special permissions to subkeys</fixtext><fix id="F-105849r1_fix" /><check system="C-99015r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open Explorer and navigate to the inetpub directory.
+
+Right-click "inetpub" and select "Properties".
+
+Click the "Security" tab.
+
+Verify the permissions for the following users; if the permissions are less restrictive, this is a finding.
+
+System: Full control
+Administrators: Full control
+TrustedInstaller: Full control
+ALL APPLICATION PACKAGES (built-in security group): Read and execute
+ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute
+Users: Read and execute, list folder contents
+CREATOR OWNER: Full Control, Subfolders and files only</check-content></check></Rule></Group><Group id="V-100165"><title>SRG-APP-000357-WSR-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109269r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000145</version><title>The IIS 10.0 web server must use a logging mechanism configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 10.0 web server.</title><description>&lt;VulnDiscussion&gt;To ensure the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity.
+
+The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-105851r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "IIS" double-click on the "Logging" icon.
+
+If necessary, in the "Logging" configuration box, re-designate a log path to a location able to house the logs.
+
+Under "Log File Rollover", de-select the "Do not create new log files" setting.
+
+Configure a schedule to rollover log files on a regular basis.</fixtext><fix id="F-105851r1_fix" /><check system="C-99017r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "IIS" double-click the "Logging" icon.
+
+In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.
+
+Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.
+
+Under "Log File Rollover", verify "Do not create new log files" is not selected.
+
+Verify a schedule is configured to rollover log files on a regular basis.
+
+Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device.
+
+If the designated logging path device is not of sufficient space to maintain all log files, and there is not a schedule to rollover files on a regular basis, this is a finding.</check-content></check></Rule></Group><Group id="V-100167"><title>SRG-APP-000380-WSR-000072</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109271r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000147</version><title>Access to web administration tools must be restricted to the web manager and the web managers designees.</title><description>&lt;VulnDiscussion&gt;A web server can be modified through parameter modification, patch installation, upgrades to the web server or modules, and security parameter changes. With each of these changes, there is the potential for an adverse effect such as a DoS, web server instability, or hosted application instability.
+
+To limit changes to the web server and limit exposure to any adverse effects from the changes, files such as the web server application files, libraries, and configuration files must have permissions and ownership set properly to only allow privileged users access.
+
+The key web service administrative and configuration tools must only be accessible by the web server staff. All users granted this authority will be documented and approved by the ISSO. Access to the IIS Manager will be limited to authorized users and administrators.
+
+Satisfies: SRG-APP-000380-WSR-000072, SRG-APP-000435-WSR-000147, SRG-APP-000033-WSR-000169&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000213</ident><ident system="http://iase.disa.mil/cci">CCI-001813</ident><ident system="http://iase.disa.mil/cci">CCI-002385</ident><fixtext fixref="F-105853r1_fix">Restrict access to the web administration tool to only the web manager and the web manager’s designees.</fixtext><fix id="F-105853r1_fix" /><check system="C-99019r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Right-click "InetMgr.exe", then click "Properties" from the "Context" menu.
+
+Select the "Security" tab.
+
+Review the groups and user names.
+
+The following accounts may have Full control privileges:
+
+TrustedInstaller
+Web Managers
+Web Manager designees
+CREATOR OWNER: Full Control, Subfolders and files only
+
+The following accounts may have read and execute, or read permissions:
+
+Non Web Manager Administrators
+ALL APPLICATION PACKAGES (built-in security group)
+ALL RESTRICTED APPLICATION PACKAGES (built-in security group)
+SYSTEM
+Users
+
+Specific users may be granted read and execute and read permissions.
+
+Compare the local documentation authorizing specific users, against the users observed when reviewing the groups and users.
+
+If any other access is observed, this is a finding.</check-content></check></Rule></Group><Group id="V-100169"><title>SRG-APP-000383-WSR-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109273r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000148</version><title>The IIS 10.0 web server must not be running on a system providing any other role.</title><description>&lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.
+
+The web server must provide the capability to disable or deactivate network-related services deemed non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001762</ident><fixtext fixref="F-105855r1_fix">Remove all unapproved programs and roles from the production web server.</fixtext><fix id="F-105855r1_fix" /><check system="C-99021r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Review programs installed on the OS.
+
+Open Control Panel.
+
+Open Programs and Features.
+
+The following programs may be installed without any additional documentation:
+
+Administration Pack for IIS
+IIS Search Engine Optimization Toolkit
+Microsoft .NET Framework version 3.5 SP1 or greater
+Microsoft Web Platform Installer version 3.x or greater
+Virtual Machine Additions
+
+Review the installed programs, if any programs are installed other than those listed above, this is a finding.
+
+Note: If additional software is needed and has supporting documentation signed by the ISSO, this is not a finding.</check-content></check></Rule></Group><Group id="V-100171"><title>SRG-APP-000383-WSR-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109275r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000149</version><title>The Internet Printing Protocol (IPP) must be disabled on the IIS 10.0 web server.</title><description>&lt;VulnDiscussion&gt;The use of IPP on an IIS web server allows client access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001762</ident><fixtext fixref="F-105857r1_fix">Click “Start”, click “Administrative Tools”, and then click “Server Manager”.
+
+Expand the roles node, right-click “Print Services”, and then select “Remove Roles Services”.
+
+If the Internet Printing option is checked, clear the check box, click “Next”, and then click “Remove” to complete the wizard.</fixtext><fix id="F-105857r1_fix" /><check system="C-99023r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable.
+
+Navigate to the following directory:
+
+%windir%\web\printers
+
+If this folder exists, this is a finding.
+
+Determine whether Internet Printing is enabled:
+
+Click “Start”, click “Administrative Tools”, and then click “Server Manager”.
+
+Expand the roles node, right-click “Print Services”, and then select “Remove Roles Services”.
+
+If the Internet Printing option is enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-100173"><title>SRG-APP-000435-WSR-000148</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109277r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000151</version><title>The IIS 10.0 web server must be tuned to handle the operational requirements of the hosted application.</title><description>&lt;VulnDiscussion&gt;A Denial of Service (DoS) can occur when the web server is overwhelmed and can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002385</ident><fixtext fixref="F-105859r1_fix">Access the IIS 10.0 web server registry.
+
+Verify the following keys are present and configured. The required setting depends upon the requirements of the application. These settings must be explicitly configured to show a conscientious tuning has been made.
+
+Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\
+
+Configure the following registry keys to levels to accommodate the hosted applications.
+
+"URIEnableCache"
+"UriMaxUriBytes"
+"UriScavengerPeriod"</fixtext><fix id="F-105859r1_fix" /><check system="C-99025r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>If the IIS 10.0 web server is not hosting any applications, this is Not Applicable.
+
+If the IIS 10.0 web server is hosting applications, consult with the System Administrator to determine risk analysis performed when the application was written and deployed to the IIS 10.0 web server.
+
+Obtain documentation on the configuration.
+
+Verify, at a minimum, the following tuning settings in the registry.
+
+Access the IIS 10.0 web server registry.
+
+Verify the following keys are present and configured. The required setting depends upon the requirements of the application.
+
+Recommended settings are not provided as these settings must be explicitly configured to show a conscientious tuning has been made.
+
+Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\
+"URIEnableCache"
+"UriMaxUriBytes"
+"UriScavengerPeriod"
+
+If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" and "UriScavengerPeriod", this is a finding.</check-content></check></Rule></Group><Group id="V-100175"><title>SRG-APP-000439-WSR-000152</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109279r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000152</version><title>IIS 10.0 web server session IDs must be sent to the client using TLS.</title><description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-105861r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select "system.webServer/asp".
+
+Expand the "session" section.
+
+Select "True" for the "keepSessionIdSecure" setting.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105861r1_fix" /><check system="C-99027r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under the "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select "system.webServer/asp".
+
+Expand the "session" section.
+
+Verify the "keepSessionIdSecure" is set to "True".
+
+If the "keepSessionIdSecure" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-100177"><title>SRG-APP-000439-WSR-000156</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109281r1_rule" severity="high" weight="10.0"><version>IIST-SV-000153</version><title>An IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.</title><description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-105863r1_fix">Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to the following registry paths and configure the "DisabledByDefault" REG_DWORD with the appropriate values:
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+With a REG_DWORD value of "0" for "DisabledByDefault"
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+With a REG_DWORD value of "1" for "DisabledByDefault"
+
+With a REG_DWORD value of "0" for "Enabled"</fixtext><fix id="F-105863r1_fix" /><check system="C-99029r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</check-content></check></Rule></Group><Group id="V-100179"><title>SRG-APP-000439-WSR-000156</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109283r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000154</version><title>The IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.</title><description>&lt;VulnDiscussion&gt;TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2-approved TLS versions must be enabled and non-FIPS-approved SSL versions must be disabled.
+
+NIST SP 800-52 defines the approved TLS versions for government applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-105865r1_fix">Configure the web server to use an approved TLS version according to NIST SP 800-52 and to disable all non-approved versions.</fixtext><fix id="F-105865r1_fix" /><check system="C-99033r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Review the web server documentation and deployed configuration to determine which version of TLS is being used.
+
+If the TLS version is not TLS 1.2 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-100181"><title>SRG-APP-000516-WSR-000079</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109285r1_rule" severity="high" weight="10.0"><version>IIST-SV-000156</version><title>All accounts installed with the IIS 10.0 web server software and tools must have passwords assigned and default passwords changed.</title><description>&lt;VulnDiscussion&gt;During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community.
+
+The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.
+
+Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105867r1_fix">Access the IIS 10.0 web server.
+
+Access the "Apps" menu. Under Administrative Tools, select Computer Management.
+
+In left pane, expand "Local Users and Groups" and click on "Users".
+
+Change passwords for any local accounts present that are used by IIS 10.0, then verify with System Administrator default passwords have been changed.
+
+Develop an internal process for changing passwords on a regular basis.</fixtext><fix id="F-105867r1_fix" /><check system="C-99035r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 web server.
+
+Access the "Apps" menu. Under "Administrative Tools", select "Computer Management".
+
+In left pane, expand "Local Users and Groups" and click "Users".
+
+Review the local users listed in the middle pane.
+
+If any local accounts are present and used by IIS 10.0, verify with System Administrator that default passwords have been changed.
+
+If passwords have not been changed from the default, this is a finding.</check-content></check></Rule></Group><Group id="V-100183"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109287r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000158</version><title>Unspecified file extensions on a production IIS 10.0 web server must be removed.</title><description>&lt;VulnDiscussion&gt;By allowing unspecified file extensions to execute, the web servers attack surface is significantly increased. This increased risk can be reduced by only allowing specific ISAPI extensions or CGI extensions to run on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105869r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "ISAPI and CGI restrictions" icon.
+
+Click "Edit Feature Settings".
+
+Remove the check from the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes.
+
+Click "OK".</fixtext><fix id="F-105869r1_fix" /><check system="C-99037r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "ISAPI and CGI restrictions" icon.
+
+Click “Edit Feature Settings".
+
+Verify the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are NOT checked.
+
+If either or both of the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are checked, this is a finding.</check-content></check></Rule></Group><Group id="V-100185"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109289r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000159</version><title>The IIS 10.0 web server must have a global authorization rule configured to restrict access.</title><description>&lt;VulnDiscussion&gt;Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105871r1_fix">Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Authorization Rules" icon.
+
+Remove all users other than "Administrator".</fixtext><fix id="F-105871r1_fix" /><check system="C-99039r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the ".NET Authorization Rules" icon.
+
+If any user other than "Administrator" is listed, this is a finding.
+
+If .NET is not installed, this is Not Applicable.</check-content></check></Rule></Group><Group id="V-100187"><title>SRG-APP-000001-WSR-000001</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109291r1_rule" severity="medium" weight="10.0"><version>IIST-SV-000200</version><title>The IIS 10.0 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.</title><description>&lt;VulnDiscussion&gt;Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-105873r1_fix">Access the IIS 10.0 IIS Manager.
+
+Click the IIS 10.0 server.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
+
+Expand "siteDefaults".
+Expand "limits".
+
+Set the "maxconnections" parameter to a value greater than zero.</fixtext><fix id="F-105873r1_fix" /><check system="C-99041r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 IIS Manager.
+
+Click the IIS 10.0 server.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
+
+Expand "siteDefaults".
+Expand "limits".
+
+Review the results and verify the value is greater than zero for the "maxconnections" parameter.
+
+If the maxconnections parameter is set to zero, this is a finding.</check-content></check></Rule></Group><Group id="V-100189"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109293r1_rule" severity="low" weight="10.0"><version>IIST-SV-000205</version><title>The IIS 10.0 web server must enable HTTP Strict Transport Security (HSTS).</title><description>&lt;VulnDiscussion&gt;HTTP Strict Transport Security (HSTS) ensures browsers always connect to a website over TLS. HSTS exists to remove the need for redirection configurations. HSTS relies on the browser, web server, and a public "Whitelist". If the browser does not support HSTS, it will be ignored.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Server</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Server</dc:subject><dc:identifier>3535</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105875r1_fix">Access the IIS 10.0 Web Server.
+
+Access an administrative command prompt and type the following commands, substituting proper domain name:
+
+%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.enabled:True" /commit:apphost
+%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.max-age:480" /commit:apphost
+%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.includeSubDomains:True" /commit:apphost
+%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.redirectHttpToHttps:True" /commit:apphost</fixtext><fix id="F-105875r1_fix" /><check system="C-99043r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Server_STIG.xml" /><check-content>Access the IIS 10.0 Web Server.
+
+Open IIS Manager.
+
+In the "Connections" pane, select the server name.
+
+In the "Features View" pane, open "HTTP Response Headers".
+
+Verify an entry exists named "Strict-Transport-Security".
+
+Open "Strict-Transport-Security" and verify the value box contains a value greater than 0.
+
+Click "OK".
+
+If HSTS has not been enabled, this is a finding.
+The recommended max age is 8 minutes (480 seconds) or greater. Any value greater than 0 is not a finding.
+If the version of Windows Server does not natively support HSTS, this is not a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R1_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R1_Manual-xccdf.log
new file mode 100644
index 000000000..52cdaafd4
--- /dev/null
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R1_Manual-xccdf.log	
@@ -0,0 +1,3 @@
+V-100191::System Administrator::""
+V-100223::System Administrator::""
+V-100229::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length approved by the ISSO, this is a finding.
diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R1_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R1_Manual-xccdf.xml
new file mode 100644
index 000000000..7f7d4a153
--- /dev/null
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R1_Manual-xccdf.xml	
@@ -0,0 +1,1272 @@
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="IIS_10-0_Site_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-24">accepted</status><title>Microsoft IIS 10.0 Site Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 1 Benchmark Date: 20 Mar 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-100191" selected="true" /><select idref="V-100193" selected="true" /><select idref="V-100195" selected="true" /><select idref="V-100197" selected="true" /><select idref="V-100199" selected="true" /><select idref="V-100201" selected="true" /><select idref="V-100203" selected="true" /><select idref="V-100205" selected="true" /><select idref="V-100207" selected="true" /><select idref="V-100209" selected="true" /><select idref="V-100211" selected="true" /><select idref="V-100213" selected="true" /><select idref="V-100215" selected="true" /><select idref="V-100217" selected="true" /><select idref="V-100219" selected="true" /><select idref="V-100221" selected="true" /><select idref="V-100223" selected="true" /><select idref="V-100225" selected="true" /><select idref="V-100227" selected="true" /><select idref="V-100229" selected="true" /><select idref="V-100231" selected="true" /><select idref="V-100233" selected="true" /><select idref="V-100235" selected="true" /><select idref="V-100237" selected="true" /><select idref="V-100239" selected="true" /><select idref="V-100241" selected="true" /><select idref="V-100243" selected="true" /><select idref="V-100245" selected="true" /><select idref="V-100247" selected="true" /><select idref="V-100249" selected="true" /><select idref="V-100251" selected="true" /><select idref="V-100253" selected="true" /><select idref="V-100255" selected="true" /><select idref="V-100257" selected="true" /><select idref="V-100259" selected="true" /><select idref="V-100261" selected="true" /><select idref="V-100263" selected="true" /><select idref="V-100265" selected="true" /><select idref="V-100267" selected="true" /><select idref="V-100269" selected="true" /><select idref="V-100271" selected="true" /><select idref="V-100273" selected="true" /><select idref="V-100275" selected="true" /><select idref="V-100277" selected="true" /><select idref="V-100279" selected="true" /><select idref="V-100281" selected="true" /><select idref="V-100283" selected="true" /><select idref="V-100285" selected="true" /></Profile><Group id="V-100191"><title>SRG-APP-000001-WSR-000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109295r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000201</version><title>The IIS 10.0 website session state must be enabled.</title><description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is either stored in a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
+
+When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
+
+ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-105877r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State Mode Settings", verify the "In Process" mode is selected.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105877r1_fix" /><check system="C-99045r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State Mode Settings", verify the "In Process" mode is selected.
+
+If the "Session State Mode Settings" is set to "In Process", this is not a finding.
+
+Alternative method:
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "mode" reflects "InProc".
+
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.</check-content></check></Rule></Group><Group id="V-100193"><title>SRG-APP-000001-WSR-000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109297r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000202</version><title>The IIS 10.0 website session state cookie settings must be configured to Use Cookies mode.</title><description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
+
+When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
+
+ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session.
+
+When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-105879r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Under the ASP.NET section, select "Session State".
+
+Under "Cookie Settings", select the "Use Cookies" from the "Mode:" drop-down list.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105879r1_fix" /><check system="C-99047r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+Click the site name.
+Under the "ASP.NET" section, select "Session State".
+Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.
+If the "Use Cookies" mode is selected, this is not a finding.
+
+Alternative method:
+Click the site name.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+Verify the "cookieless" is set to "UseCookies".
+If the "cookieless" is not set to "UseCookies", this is a finding.
+Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</check-content></check></Rule></Group><Group id="V-100195"><title>SRG-APP-000014-WSR-000006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109299r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000203</version><title>A private IIS 10.0 website must only accept Secure Socket Layer (SSL) connections.</title><description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-105881r1_fix">Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "SSL Settings" icon.
+
+Select "Require SSL" check box.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105881r1_fix" /><check system="C-99049r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+
+Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Click the site name.
+Double-click the "SSL Settings" icon.
+Verify "Require SSL" check box is selected.
+
+If the "Require SSL" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100197"><title>SRG-APP-000014-WSR-000006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109301r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000204</version><title>A public IIS 10.0 website must only accept Secure Socket Layer (SSL) connections when authentication is required.</title><description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-105883r1_fix">Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "SSL Settings" icon.
+
+Select "Require SSL" check box.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105883r1_fix" /><check system="C-99051r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "SSL Settings" icon.
+
+Verify "Require SSL" check box is selected.
+
+If the "Require SSL" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100199"><title>SRG-APP-000092-WSR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109303r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000206</version><title>Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.
+
+In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000139</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><fixtext fixref="F-105885r1_fix">Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, select the "Both log file and ETW event" radio button.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105885r1_fix" /><check system="C-99053r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.
+
+If the "Both log file and ETW event" radio button is not selected, this is a finding.
+
+Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting. More configuration information is available at:
+https://blogs.intelink.gov/blogs/_disairrt/?p=1317</check-content></check></Rule></Group><Group id="V-100201"><title>SRG-APP-000098-WSR-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109305r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000208</version><title>An IIS 10.0 website behind a load balancer or proxy server must produce log records containing the source client IP, and destination information.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the correct source (e.g., source IP), of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the loggable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.
+
+A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000133</ident><fixtext fixref="F-105887r1_fix">Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 10.0 web server transparently.</fixtext><fix id="F-105887r1_fix" /><check system="C-99055r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy.
+
+If the IIS 10.0 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Click "View log file".
+
+When log file is displayed, review source IP information in log entries and verify entries do not reflect the IP address of the proxy server.
+
+If the website is not behind a load balancer or proxy server, this is Not Applicable.
+
+If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
+
+If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</check-content></check></Rule></Group><Group id="V-100203"><title>SRG-APP-000099-WSR-000061</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109307r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000209</version><title>The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.
+
+Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000134</ident><fixtext fixref="F-105889r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Select the website being reviewed.
+
+Under "IIS", double-click the "Logging" icon.
+
+Configure the "Format:" under "Log File" to "W3C".
+
+Select "Fields".
+
+Under "Custom Fields", select the following fields:
+
+Request Header &gt;&gt; Connection
+
+Request Header &gt;&gt; Warning
+
+Click "OK".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105889r1_fix" /><check system="C-99057r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Select the website being reviewed.
+
+Under "IIS", double-click the "Logging" icon.
+
+Verify the "Format:" under "Log File" is configured to "W3C".
+
+Select "Fields".
+
+Under "Custom Fields", verify the following fields are selected:
+
+Request Header &gt;&gt; Connection
+
+Request Header &gt;&gt; Warning
+
+If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100205"><title>SRG-APP-000100-WSR-000064</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109309r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000210</version><title>The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
+
+Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001487</ident><fixtext fixref="F-105891r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Select the website being reviewed.
+
+Under "IIS", double-click the "Logging" icon.
+
+Configure the "Format:" under "Log File" to "W3C".
+
+Select "Fields".
+
+Under "Standard Fields", select "User Agent", "User Name", and "Referrer".
+
+Under "Custom Fields", select the following fields:
+
+Request Header &gt;&gt; Authorization
+
+Response Header &gt;&gt; Content-Type
+
+Click "OK".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105891r1_fix" /><check system="C-99059r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Under "IIS", double-click the "Logging" icon.
+
+Verify the "Format:" under "Log File" is configured to "W3C".
+
+Select "Fields".
+
+Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected.
+
+Under "Custom Fields", verify the following fields have been configured:
+
+Request Header &gt;&gt; Authorization
+
+Response Header &gt;&gt; Content-Type
+
+If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100207"><title>SRG-APP-000141-WSR-000081</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109311r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000214</version><title>The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.</title><description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner.
+
+A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105893r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click on the IIS 10.0 site.
+
+Under IIS, double-click the “MIME Types” icon.
+
+From the "Group by:" drop-down list, select "Content Type".
+
+From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions:
+
+.exe
+.dll
+.com
+.bat
+.csh
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105893r1_fix" /><check system="C-99061r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click on the IIS 10.0 site.
+
+Under IIS, double-click the “MIME Types” icon.
+
+From the "Group by:" drop-down list, select "Content Type".
+
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+
+.exe
+.dll
+.com
+.bat
+.csh
+
+If any OS shell MIME types are configured, this is a finding.</check-content></check></Rule></Group><Group id="V-100209"><title>SRG-APP-000141-WSR-000082</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109313r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000215</version><title>Mappings to unused and vulnerable scripts on the IIS 10.0 website must be removed.</title><description>&lt;VulnDiscussion&gt;IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings.
+
+For Handler Mappings, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 8. Handler Mappings at the site level take precedence over Handler Mappings at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105895r1_fix">Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click "Handler Mappings".
+
+Remove any script file extensions listed on the black list that are enabled.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105895r1_fix" /><check system="C-99063r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 10.0. Handler Mappings at the site level take precedence over Handler Mappings at the server level.
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click "Handler Mappings".
+
+If any script file extensions from the black list are enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-100211"><title>SRG-APP-000141-WSR-000083</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109315r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000216</version><title>The IIS 10.0 website must have resource mappings set to disable the serving of certain file types.</title><description>&lt;VulnDiscussion&gt;IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings.
+
+For Request Filtering, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105897r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name to review.
+
+Double-click Request Filtering-&gt;File Name Extensions Tab-&gt;Deny File Name Extension.
+
+Add any script file extensions listed on the black list that are not listed.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105897r1_fix" /><check system="C-99065r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name to review.
+
+Double-click Request Filtering-&gt;File Name Extensions Tab.
+
+If any script file extensions from the black list are not denied, this is a finding.</check-content></check></Rule></Group><Group id="V-100213"><title>SRG-APP-000141-WSR-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109317r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000217</version><title>The IIS 10.0 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.</title><description>&lt;VulnDiscussion&gt;A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.
+
+WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105899r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access Server Manager on the IIS 10.0 website.
+
+Select the "Local Server".
+
+Click "Manage".
+
+Select "Add Roles and Features".
+
+Click "Next" in the "Before you begin" dialog box.
+
+Select "Role-based or feature-based installation" in the "Installation Type" dialog box and click "Next".
+
+Select the IIS 10.0 web server on the "Server Selection" dialog box.
+
+From the "Windows Features" dialog box, navigate to "World Wide Web Services" &gt;&gt; "Common HTTP Features".
+
+De-select "WebDAV Publishing" and click "Next" to complete removing the WebDAV Publishing feature from the IIS 10.0 web server.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105899r1_fix" /><check system="C-99067r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Select the IIS 10.0 website.
+
+Review the features listed under the "IIS" section.
+
+If the "WebDAV Authoring Rules" icon exists, this is a finding.</check-content></check></Rule></Group><Group id="V-100215"><title>SRG-APP-000141-WSR-000086</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109319r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000218</version><title>The IIS 10.0 production website must configure the Global .NET Trust Level.</title><description>&lt;VulnDiscussion&gt;A web server may host too many applications. Each application will need certain system resources and privileged operations to operate correctly. An application's trust level determines the permissions granted by the ASP.NET Code Access Security (CAS) policy. An application with full trust permissions may access all resource types on a server and perform privileged operations, while applications running with partial trust have varying levels of operating permissions and access to resources. The CAS determines the permissions granted to the application on the server. Setting a level of trust compatible with the applications will limit the potential harm a compromised application could cause to a system. The web server must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation.
+
+Limiting the application will confine the potential harm a compromised application could cause to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;The IIS 10.0 production website must configure the Global .NET Trust Level.&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105901r1_fix">Note: If the server being reviewed is a non-production website, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the ".NET Trust Level" icon.
+
+Set the ".NET Trust Level" to Full or less and click “Apply”.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105901r1_fix" /><check system="C-99069r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a non-production website, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the ".NET Trust Level" icon.
+
+If the ".NET Trust Level" is not set to Full or less, this is a finding.</check-content></check></Rule></Group><Group id="V-100217"><title>SRG-APP-000142-WSR-000089</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109321r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000219</version><title>Each IIS 10.0 website must be assigned a default host header.</title><description>&lt;VulnDiscussion&gt;The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to use, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address.
+
+Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-105903r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Right-click on the site name under review.
+
+Select "Edit Bindings".
+
+Assign hostname entries and unique IP addresses to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
+
+Click "OK".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105903r1_fix" /><check system="C-99071r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Right-click on the site name under review.
+Select "Edit Bindings".
+
+Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
+
+If both hostname entries and unique IP addresses are not configured to port 80 for HTTP and port 443 for HTTPS (or other approved and documented port), this is a finding.
+
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Note: If HTTP/Port 80 is not being used, and is not configured as above, this is not a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</check-content></check></Rule></Group><Group id="V-100219"><title>SRG-APP-000172-WSR-000104</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109323r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000220</version><title>A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.</title><description>&lt;VulnDiscussion&gt;A DoD private website must use PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites.
+
+Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000197</ident><ident system="http://iase.disa.mil/cci">CCI-001188</ident><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-105905r1_fix">Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Double-click the "SSL Settings" icon.
+
+Verify the "Clients Certificate Required" check box is selected.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105905r1_fix" /><check system="C-99073r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Double-click the "SSL Settings" icon.
+
+Verify the "Clients Certificate Required" check box is selected.
+
+If the "Clients Certificate Required" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-100221"><title>SRG-APP-000211-WSR-000031</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109325r1_rule" severity="high" weight="10.0"><version>IIST-SI-000221</version><title>Anonymous IIS 10.0 website access accounts must be restricted.</title><description>&lt;VulnDiscussion&gt;Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data stored on the web server must be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001082</ident><fixtext fixref="F-105907r1_fix">Remove the Anonymous access account from all privileged accounts and all privileged groups.</fixtext><fix id="F-105907r1_fix" /><check system="C-99075r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Check the account used for anonymous access to the website.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+
+Double-click "Authentication" in the IIS section of the website’s Home Pane.
+
+If Anonymous access is disabled, this is Not a Finding.
+
+If Anonymous access is enabled, click "Anonymous Authentication".
+
+Click "Edit" in the "Actions" pane.
+
+If the "Specific user" radio button is enabled and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Note: account name.
+
+Check privileged groups that may allow the anonymous account inappropriate membership:
+Open "Server Manager" on the machine.
+
+Expand Configuration.
+
+Expand Local Users and Groups.
+
+Click "Groups".
+
+Review members of any of the following privileged groups:
+
+Administrators
+Backup Operators
+Certificate Services (of any designation)
+Distributed COM Users
+Event Log Readers
+Network Configuration Operators
+Performance Log Users
+Performance Monitor Users
+Power Users
+Print Operators
+Remote Desktop Users
+Replicator
+
+Double-click each group and review its members.
+
+If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.</check-content></check></Rule></Group><Group id="V-100223"><title>SRG-APP-000224-WSR-000136</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109327r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000223</version><title>The IIS 10.0 website must generate unique session identifiers that cannot be reliably reproduced.</title><description>&lt;VulnDiscussion&gt;Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. To maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application.
+
+By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID.
+
+The session ID generator must be a FIPS 140-2-approved generator.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001188</ident><fixtext fixref="F-105909r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Under the ASP.NET section, select "Session State".
+
+Under "Session State" Mode Settings, select the "In Process" mode.</fixtext><fix id="F-105909r1_fix" /><check system="C-99077r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State" Mode Settings, verify the "In Process" mode is selected.
+
+If the "In Process" mode is selected, this is not a finding.
+
+Alternative method:
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "mode" reflects "InProc".
+
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.</check-content></check></Rule></Group><Group id="V-100225"><title>SRG-APP-000233-WSR-000146</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109329r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000224</version><title>The IIS 10.0 website document directory must be in a separate partition from the IIS 10.0 websites system files.</title><description>&lt;VulnDiscussion&gt;The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file, the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001084</ident><fixtext fixref="F-105911r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Click the "Advanced Settings" from the "Actions" pane.
+
+Change the Physical Path to the new partition and directory location.</fixtext><fix id="F-105911r1_fix" /><check system="C-99079r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Click the "Advanced Settings" from the "Actions" pane.
+
+Review the Physical Path.
+
+If the Path is on the same partition as the OS, this is a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</check-content></check></Rule></Group><Group id="V-100227"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109331r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000225</version><title>The IIS 10.0 website must be configured to limit the maxURL.</title><description>&lt;VulnDiscussion&gt;Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-105913r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+Set the "maxURL" value to "4096" or less.</fixtext><fix id="F-105913r1_fix" /><check system="C-99081r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "maxUrl" value is not set to "4096" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-100229"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109333r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000226</version><title>The IIS 10.0 website must be configured to limit the size of web requests.</title><description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-105915r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+Set the "maxAllowedContentLength" value to "30000000" or less.</fixtext><fix id="F-105915r1_fix" /><check system="C-99083r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.</check-content></check></Rule></Group><Group id="V-100231"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109335r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000227</version><title>The IIS 10.0 websites Maximum Query String limit must be configured.</title><description>&lt;VulnDiscussion&gt;Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-105917r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+Set the "Maximum Query String" value to "2048" or less.</fixtext><fix id="F-105917r1_fix" /><check system="C-99085r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If the "Maximum Query String" value is not set to "2048" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-100233"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109337r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000228</version><title>Non-ASCII characters in URLs must be prohibited by any IIS 10.0 website.</title><description>&lt;VulnDiscussion&gt;Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-105919r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+Uncheck the "Allow high-bit characters" check box.</fixtext><fix id="F-105919r1_fix" /><check system="C-99087r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "Allow high-bit characters" check box is checked, this is a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</check-content></check></Rule></Group><Group id="V-100235"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109339r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000229</version><title>Double encoded URL requests must be prohibited by any IIS 10.0 website.</title><description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the "Allow double escaping" option is disabled, it prevents attacks that rely on double-encoded requests.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-105921r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+Uncheck the "Allow double escaping" check box.</fixtext><fix id="F-105921r1_fix" /><check system="C-99089r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "Allow double escaping" check box is checked, this is a finding.</check-content></check></Rule></Group><Group id="V-100237"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109341r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000230</version><title>Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.</title><description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the "File Extensions Request" filter enables rejection of requests containing specific file extensions not defined in the "File Extensions" filter. Tripping this filter will cause IIS to generate a Status Code 404.7.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-105923r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+Uncheck the "Allow unlisted file extensions" check box.</fixtext><fix id="F-105923r1_fix" /><check system="C-99091r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "Allow unlisted file name extensions" check box is checked, this is a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</check-content></check></Rule></Group><Group id="V-100239"><title>SRG-APP-000251-WSR-000157</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109343r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000231</version><title>Directory Browsing on the IIS 10.0 website must be disabled.</title><description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001310</ident><fixtext fixref="F-105925r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the Site.
+
+Double-click the "Directory Browsing" icon.
+
+Under the "Actions" pane, click "Disabled".</fixtext><fix id="F-105925r1_fix" /><check system="C-99093r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Click the Site.
+
+Double-click the "Directory Browsing" icon.
+
+If "Directory Browsing" is not installed, this is Not Applicable.
+
+Under the "Actions" pane, verify "Directory Browsing" is "Disabled".
+
+If "Directory Browsing" is not "Disabled", this is a finding.</check-content></check></Rule></Group><Group id="V-100241"><title>SRG-APP-000266-WSR-000159</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109345r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000233</version><title>Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 website, patches, loaded modules, and directory paths.</title><description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-105927r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Error Pages" icon.
+
+Click each error message and click "Edit Feature" Setting from the "Actions" pane; set each error message to "Detailed errors for local requests and custom error pages for remote requests".</fixtext><fix id="F-105927r1_fix" /><check system="C-99095r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Error Pages" icon.
+
+Click each error message and click "Edit Feature" setting from the "Actions" pane.
+
+If any error message is not set to "Detailed errors for local requests and custom error pages for remote requests", this is a finding.</check-content></check></Rule></Group><Group id="V-100243"><title>SRG-APP-000266-WSR-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109347r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000234</version><title>Debugging and trace information used to diagnose the IIS 10.0 website must be disabled.</title><description>&lt;VulnDiscussion&gt;Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-105929r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click ".NET Compilation".
+
+Scroll down to the "Behavior" section and set the value for "Debug" to "False".</fixtext><fix id="F-105929r1_fix" /><check system="C-99097r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the ".NET feature" is not installed, this check is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click ".NET Compilation".
+
+Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False".
+
+If the "Debug" value is not set to "False", this is a finding.</check-content></check></Rule></Group><Group id="V-100245"><title>SRG-APP-000295-WSR-000012</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109349r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000235</version><title>The Idle Time-out monitor for each IIS 10.0 website must be enabled.</title><description>&lt;VulnDiscussion&gt;The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received.
+
+The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes.
+
+By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-105931r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the Application Pools.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Process Model" section and set the value for "Idle Time-out" to something other than "0". "20" or less is recommended if the amount of RAM on the system is limited.</fixtext><fix id="F-105931r1_fix" /><check system="C-99099r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Click the Application Pools.
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is not "0".
+
+If the "Idle Time-out" is set to "0", this is a finding.</check-content></check></Rule></Group><Group id="V-100247"><title>SRG-APP-000295-WSR-000134</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109351r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000236</version><title>The IIS 10.0 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.</title><description>&lt;VulnDiscussion&gt;Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.
+
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-105933r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Set the "timeout" to "00:20:00 or less”, using the lowest value possible depending upon the application.
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.
+
+In the "Actions" pane, click "Apply".</fixtext><fix id="F-105933r1_fix" /><check system="C-99101r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "timeout" is set to "00:20:00 or less”, using the lowest value possible depending upon the application.
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.
+
+If "timeout" is not set to "00:20:00 or less”, this is a finding.</check-content></check></Rule></Group><Group id="V-100249"><title>SRG-APP-000316-WSR-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109353r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000237</version><title>The IIS 10.0 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.</title><description>&lt;VulnDiscussion&gt;During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.
+
+The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.
+
+The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002322</ident><fixtext fixref="F-105935r1_fix">Prepare documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS 10.0 Manager.
+
+In the "Actions" pane, under "Manage Server", click "Stop".</fixtext><fix id="F-105935r1_fix" /><check system="C-99103r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Interview the System Administrator and Web Manager.
+
+Ask for documentation for the IIS 10.0 web server administration.
+
+Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS 10.0 Manager.
+
+In the "Actions" pane, under "Manage Server", click "Stop".
+
+If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.</check-content></check></Rule></Group><Group id="V-100251"><title>SRG-APP-000357-WSR-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109355r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000238</version><title>The IIS 10.0 website must use a logging mechanism configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 10.0 website.</title><description>&lt;VulnDiscussion&gt;To make certain the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity.
+
+The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-105937r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Under "IIS" double-click on the "Logging" icon.
+
+If necessary, in the "Logging" configuration box, redesignate a log path to a location able to house the logs.
+
+Under "Log File Rollover", deselect the "Do not create new log files" setting.
+
+Configure a schedule to rollover log files on a regular basis.</fixtext><fix id="F-105937r1_fix" /><check system="C-99105r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Under "IIS" double-click on the "Logging" icon.
+
+In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.
+
+Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.
+
+Under "Log File Rollover", verify "Do not create new log files" is not selected.
+
+Verify a schedule is configured to rollover log files on a regular basis.
+
+Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device.
+
+If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.</check-content></check></Rule></Group><Group id="V-100253"><title>SRG-APP-000383-WSR-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109357r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000239</version><title>The IIS 10.0 websites must use ports, protocols, and services according to Ports, Protocols, and Services Management (PPSM) guidelines.</title><description>&lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.
+
+The web server must provide the capability to disable or deactivate network-related services deemed to be non-essential to the server mission, too unsecure, or prohibited by the PPSM CAL and vulnerability assessments.
+
+Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS.
+
+The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, PPSM, and the associated PPS Assurance Category Assignments List.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001762</ident><fixtext fixref="F-105939r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+In the "Action" Pane, click "Bindings".
+
+Edit to change an existing binding and set the correct ports and protocol.</fixtext><fix id="F-105939r1_fix" /><check system="C-99107r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+In the "Action" Pane, click "Bindings".
+
+Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.</check-content></check></Rule></Group><Group id="V-100255"><title>SRG-APP-000427-WSR-000186</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109359r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000241</version><title>The IIS 10.0 website must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).</title><description>&lt;VulnDiscussion&gt;The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-105941r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the Server name.
+
+Double-click "Server Certificates".
+
+Click "Import" under the "Actions" pane.
+
+Browse to the DoD certificate location, select it, and click "OK".
+
+Remove any non-DoD certificates if present.
+
+Click on the site needing the certificate.
+
+Select "Bindings" under the "Actions" pane.
+
+Click on the binding needing a certificate and select "Edit", or add a site binding for HTTPS.
+
+Assign the certificate to the website by choosing it under the "SSL Certificate" drop-down and clicking "OK".</fixtext><fix id="F-105941r1_fix" /><check system="C-99109r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Click "Bindings" in the "Action" Pane.
+
+Click the "HTTPS type" from the box.
+
+Click "Edit".
+
+Click "View" and then review and verify the certificate path.
+
+If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding.
+
+If HTTPS is not an available type under site bindings, this is a finding.
+
+If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server with IP address and Domain Restrictions in place, this is not a finding.</check-content></check></Rule></Group><Group id="V-100257"><title>SRG-APP-000429-WSR-000113</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109361r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000242</version><title>The IIS 10.0 private website must employ cryptographic mechanisms (TLS) and require client certificates.</title><description>&lt;VulnDiscussion&gt;When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server.
+
+Satisfies: SRG-APP-000429-WSR-000113, SRG-APP-000439-WSR-000151, SRG-APP-000441-WSR-000181, SRG-APP-000442-WSR-000182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002476</ident><fixtext fixref="F-105943r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Double-click the "SSL Settings" icon under the "IIS" section.
+
+Select the "Require SSL" setting.
+
+Select the "Client Certificates Required" setting.
+
+Click "Apply" in the "Actions" pane.
+
+Click the site under review.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.webServer/security/access".
+
+Click on the drop-down list for "sslFlags".
+
+Select the "Ssl128" check box.
+
+Click "Apply" in the "Actions" pane.</fixtext><fix id="F-105943r1_fix" /><check system="C-99111r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Note: If this is a public facing web server, this requirement is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Double-click the "SSL Settings" icon under the "IIS" section.
+Verify "Require SSL" is checked.
+Verify "Client Certificates Required" is selected.
+Click the site under review.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.webServer/security/access".
+The value for "sslFlags" set must include "ssl128".
+
+If the "Require SSL" is not selected, this is a finding.
+If the "Client Certificates Required" is not selected, this is a finding.
+If the "sslFlags" is not set to "ssl128", this is a finding.</check-content></check></Rule></Group><Group id="V-100259"><title>SRG-APP-000439-WSR-000152</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109363r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000244</version><title>IIS 10.0 website session IDs must be sent to the client using TLS.</title><description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-105945r1_fix">Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+
+Select the website being reviewed.
+
+Under "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select "system.webServer/asp".
+
+Expand the "session" section.
+
+Select "True" for the "keepSessionIdSecure" setting.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105945r1_fix" /><check system="C-99113r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+
+Select the website being reviewed.
+
+Under "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select "system.webServer/asp".
+
+Expand the "session" section.
+
+Verify the "keepSessionIdSecure" is set to "True".
+
+If the "keepSessionIdSecure" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-100261"><title>SRG-APP-000439-WSR-000154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109365r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000246</version><title>Cookies exchanged between the IIS 10.0 website and the client must have cookie properties set to prohibit client-side scripts from reading the cookie data.</title><description>&lt;VulnDiscussion&gt;A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e., HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.
+
+Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-105947r1_fix">Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+Under "Management" section, double-click the "Configuration Editor" icon.
+From the "Section:" drop-down list, select "system.web/httpCookies".
+Set the "require SSL" to "True".
+
+From the "Section:" drop-down list, select "system.web/sessionState".
+Set the "compressionEnabled" to "False".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-105947r1_fix" /><check system="C-99115r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+Under the "Management" section, double-click the "Configuration Editor" icon.
+From the "Section:" drop-down list, select "system.web/httpCookies".
+Verify the "require SSL" is set to "True".
+
+From the "Section:" drop-down list, select "system.web/sessionState".
+Verify the "compressionEnabled" is set to "False".
+
+If both the "system.web/httpCookies:require SSL" is set to "True" and the "system.web/sessionState:compressionEnabled" is set to "False", this is not a finding.</check-content></check></Rule></Group><Group id="V-100263"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109367r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000251</version><title>The IIS 10.0 website must have a unique application pool.</title><description>&lt;VulnDiscussion&gt;Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105949r1_fix">Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Assign a unique application pool to each website.</fixtext><fix id="F-105949r1_fix" /><check system="C-99117r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+In the list of Application Pools, review the "Applications" column and verify unique application pools for each website.
+
+If any Application Pools are being used for more than one website, this is a finding.</check-content></check></Rule></Group><Group id="V-100265"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109369r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000252</version><title>The maximum number of requests an application pool can process for each IIS 10.0 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105951r1_fix">Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling section" and set the value for "Request Limit" to greater than "0".
+
+Click "OK".</fixtext><fix id="F-105951r1_fix" /><check system="C-99119r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform for each Application Pool.
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0".
+
+If the "Request Limit" is set to a value of "0", this is a finding.</check-content></check></Rule></Group><Group id="V-100267"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109371r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000253</version><title>The amount of virtual memory an application pool uses for each IIS 10.0 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105953r1_fix">Open the IIS 10.0 Manager.
+
+Click “Application Pools”.
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+In the "Advanced Settings" dialog box scroll down to the "Recycling" section and set the value for "Virtual Memory Limit" to a value other than "0".
+
+Click "OK".</fixtext><fix id="F-105953r1_fix" /><check system="C-99121r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the Action Pane.
+
+In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to "0".
+
+If the value for "Virtual Memory Limit" is set to "0", this is a finding.</check-content></check></Rule></Group><Group id="V-100269"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109373r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000254</version><title>The amount of private memory an application pool uses for each IIS 10.0 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105955r1_fix">Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and set the value for "Private Memory Limit" to a value other than "0".</fixtext><fix id="F-105955r1_fix" /><check system="C-99123r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and verify the value for "Private Memory Limit" is set to a value other than "0".
+
+If the "Private Memory Limit" is set to a value of "0", this is a finding.</check-content></check></Rule></Group><Group id="V-100271"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109375r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000255</version><title>The application pool for each IIS 10.0 website must have a recycle time explicitly set.</title><description>&lt;VulnDiscussion&gt;Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105957r1_fix">Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section.
+
+Set both the "Regular time interval" and "Specific time" options to "True".</fixtext><fix id="F-105957r1_fix" /><check system="C-99125r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section.
+
+Verify both the "Regular time interval" and "Specific time" options are set to "True".
+
+If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-100273"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109377r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000257</version><title>The application pools pinging monitor for each IIS 10.0 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105959r1_fix">Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Process Model" section and set the value for "Ping Enabled" to "True".
+
+Click "OK".</fixtext><fix id="F-105959r1_fix" /><check system="C-99127r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Open the Internet Information Services (IIS) Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Process Model" section and verify the value for "Ping Enabled" is set to "True".
+
+If the value for "Ping Enabled" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-100275"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109379r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000258</version><title>The application pools rapid fail protection for each IIS 10.0 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection, the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105961r1_fix">Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and set the value for "Enabled" to "True".
+
+Click "OK".</fixtext><fix id="F-105961r1_fix" /><check system="C-99129r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True".
+
+If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-100277"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109381r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000259</version><title>The application pools rapid fail protection settings for each IIS 10.0 website must be managed.</title><description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105963r1_fix">Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and set the value for "Failure Interval" to "5" or less.
+
+Click "OK".</fixtext><fix id="F-105963r1_fix" /><check system="C-99131r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5".
+
+If the "Failure Interval" is not set to "5" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-100279"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109383r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000261</version><title>Interactive scripts on the IIS 10.0 web server must be located in unique and designated folders.</title><description>&lt;VulnDiscussion&gt;CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the System Administrator (SA) control over what goes into those folders and to facilitate access control at the folder level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105965r1_fix">All interactive programs must be placed in unique designated folders based on CGI or ASP script type.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web server name and select "Explore".
+
+Search for the listed script extensions.
+
+Move each script type to its unique designated folder.
+
+Set the permissions to the scripts folders as follows:
+
+Administrators: FULL
+TrustedInstaller: FULL
+SYSTEM: FULL
+ApplicationPoolId:READ
+Custom Service Account: READ
+Users: READ
+ALL APPLICATION PACKAGES: READ</fixtext><fix id="F-105965r1_fix" /><check system="C-99133r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp.
+
+All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web site name and select "Explore".
+
+Search for the listed script extensions. Each script type must be in its unique designated folder.
+
+If scripts are not segregated from web content and in their own unique folders, this is a finding.</check-content></check></Rule></Group><Group id="V-100281"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109385r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000262</version><title>Interactive scripts on the IIS 10.0 web server must have restrictive access controls.</title><description>&lt;VulnDiscussion&gt;CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension.
+
+The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the System Administrator (SA) or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105967r1_fix">Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp.
+
+If the website does not utilize CGI, this finding is NA.
+
+All interactive programs must have restrictive permissions.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web server name and select "Explore".
+
+Search for the listed script extensions.
+
+Set the permissions to the CGI scripts as follows:
+
+Administrators: FULL
+TrustedInstaller: FULL
+ALL APPLICATION PACKAGES: Read
+ALL RESTRICTED APPLICATION PACKAGES: Read
+SYSTEM: FULL
+ApplicationPoolId: READ
+Custom Service Account: READ
+Users: READ</fixtext><fix id="F-105967r1_fix" /><check system="C-99135r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp.
+
+If the website does not utilize CGI, this finding is Not Applicable.
+
+All interactive programs must have restrictive permissions.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web site name and select "Explore".
+
+Search for the listed script extensions.
+
+Review the permissions to the CGI scripts and verify only the permissions listed, or more restrictive permissions are assigned.
+
+Administrators: FULL
+TrustedInstaller: FULL
+ALL APPLICATION PACKAGES: Read
+ALL RESTRICTED APPLICATION PACKAGES: Read
+SYSTEM: FULL
+ApplicationPoolId: READ
+Custom Service Account: READ
+Users: READ
+
+If the permissions are less restrictive than listed above, this is a finding.</check-content></check></Rule></Group><Group id="V-100283"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109387r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000263</version><title>Backup interactive scripts on the IIS 10.0 server must be removed.</title><description>&lt;VulnDiscussion&gt;Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105969r1_fix">Remove the backup files from the production web server.</fixtext><fix id="F-105969r1_fix" /><check system="C-99137r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. The scope of this requirement is to analyze only within the web server content directories, not the entire underlying operating system.
+
+If the website does not utilize CGI, this finding is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web site name and select "Explore".
+
+Search for the listed script extensions
+
+Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.
+
+If files with these extensions are found, this is a finding.</check-content></check></Rule></Group><Group id="V-100285"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109389r1_rule" severity="medium" weight="10.0"><version>IIST-SI-000264</version><title>The required DoD banner page must be displayed to authenticated users accessing a DoD private website.</title><description>&lt;VulnDiscussion&gt;A consent banner will be in place to inform prospective entrants the website they are about to enter is a DoD website and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS 10.0 Site</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS 10.0 Site</dc:subject><dc:identifier>3537</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-105971r1_fix">Configure a DoD private website to display the required DoD banner page when authentication is required for user access.</fixtext><fix id="F-105971r1_fix" /><check system="C-99139r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_10-0_Site_STIG.xml" /><check-content>Note: This requirement is only applicable for private DoD websites.
+
+If a banner is required, the following banner page must be in place:
+
+“You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+- At any time, the USG may inspect and seize data stored on this IS.
+
+- Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+- This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy.
+
+- Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.”
+
+OR
+
+If your system cannot meet the character limits to store this amount of text in the banner, the following is another option for the warning banner:
+
+"I've read &amp; consent to terms in IS user agreem't."
+
+NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page.
+
+If the access-controlled website does not display this banner page before entry, this is a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R7_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R10_Manual-xccdf.log
similarity index 95%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R7_Manual-xccdf.log
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R10_Manual-xccdf.log
index 40adac8ec..b81dfac75 100644
--- a/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R7_Manual-xccdf.log	
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R10_Manual-xccdf.log	
@@ -1,2 +1,3 @@
 V-76695::This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files::If an account associated with roles other than auditors
 V-76759::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 0; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'; ValueData = 0; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}<splitRule>HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}
+V-76745::CREATOR OWNER: Full Control, Subfolders and files only::CREATOR OWNER: Full Control - Subfolders and files only
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R7_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R10_Manual-xccdf.xml
similarity index 82%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R7_Manual-xccdf.xml
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R10_Manual-xccdf.xml
index 5763cd370..322d61cec 100644
--- a/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R7_Manual-xccdf.xml	
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R10_Manual-xccdf.xml	
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="IIS_8-5_Server_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-03-20">accepted</status><title>IIS 8.5 Server Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 7 Benchmark Date: 26 Apr 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76763" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /></Profile><Group id="V-76679"><title>SRG-APP-000015-WSR-000014</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91375r1_rule" severity="medium" weight="10.0"><version>IISW-SV-000100</version><title>The IIS 8.5 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.</title><description>&lt;VulnDiscussion&gt;Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="IIS_8-5_Server_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-27">accepted</status><title>IIS 8.5 Server Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 10 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76679" selected="true" /><select idref="V-76681" selected="true" /><select idref="V-76683" selected="true" /><select idref="V-76685" selected="true" /><select idref="V-76687" selected="true" /><select idref="V-76689" selected="true" /><select idref="V-76695" selected="true" /><select idref="V-76697" selected="true" /><select idref="V-76699" selected="true" /><select idref="V-76701" selected="true" /><select idref="V-76703" selected="true" /><select idref="V-76705" selected="true" /><select idref="V-76707" selected="true" /><select idref="V-76709" selected="true" /><select idref="V-76711" selected="true" /><select idref="V-76713" selected="true" /><select idref="V-76715" selected="true" /><select idref="V-76717" selected="true" /><select idref="V-76719" selected="true" /><select idref="V-76721" selected="true" /><select idref="V-76725" selected="true" /><select idref="V-76727" selected="true" /><select idref="V-76729" selected="true" /><select idref="V-76731" selected="true" /><select idref="V-76733" selected="true" /><select idref="V-76735" selected="true" /><select idref="V-76737" selected="true" /><select idref="V-76739" selected="true" /><select idref="V-76741" selected="true" /><select idref="V-76743" selected="true" /><select idref="V-76745" selected="true" /><select idref="V-76747" selected="true" /><select idref="V-76749" selected="true" /><select idref="V-76751" selected="true" /><select idref="V-76753" selected="true" /><select idref="V-76755" selected="true" /><select idref="V-76757" selected="true" /><select idref="V-76759" selected="true" /><select idref="V-76761" selected="true" /><select idref="V-76765" selected="true" /><select idref="V-76767" selected="true" /><select idref="V-76769" selected="true" /><select idref="V-76771" selected="true" /><select idref="V-95633" selected="true" /></Profile><Group id="V-76679"><title>SRG-APP-000015-WSR-000014</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91375r1_rule" severity="medium" weight="10.0"><version>IISW-SV-000100</version><title>The IIS 8.5 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.</title><description>&lt;VulnDiscussion&gt;Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.
 
 An alternative to remote administration of the web server is to perform web server administration locally at the console. Local administration at the console implies physical access to the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001453</ident><fixtext fixref="F-83375r1_fix">Ensure the web server administration is only performed over a secure path.</fixtext><fix id="F-83375r1_fix" /><check system="C-76335r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>If web administration is performed at the console, this check is NA.
 
@@ -127,28 +127,26 @@ Request Header &gt;&gt; Connection
 Request Header &gt;&gt; Warning
 
 If any of the above fields are not selected, this is a finding.
-</check-content></check></Rule></Group><Group id="V-76689"><title>SRG-APP-000100-WSR-000064</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91385r3_rule" severity="medium" weight="10.0"><version>IISW-SV-000111</version><title>The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+</check-content></check></Rule></Group><Group id="V-76689"><title>SRG-APP-000100-WSR-000064</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91385r5_rule" severity="medium" weight="10.0"><version>IISW-SV-000111</version><title>The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
 
 Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
 
-Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001487</ident><fixtext fixref="F-83385r4_fix">Access the IIS 8.5 web server IIS Manager.
+Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001487</ident><fixtext fixref="F-83385r6_fix">Access the IIS 8.5 web server IIS Manager.
 Click the IIS 8.5 web server name.
 Under "IIS", double-click the "Logging" icon.
 Verify the "Format:" under "Log File" is configured to "W3C".
 Select the "Fields" button.
-Under "Standard Fields", select "User Agent", "User Name" and "Referrer".
+Under "Standard Fields", select "User Agent", "User Name", and "Referrer".
 Under "Custom Fields", select the following fields:
 Click on the "Source Type" drop-down list and select "Request Header".
-Click on the "Source Type" drop-down list and select "Request Header".
 Click on the "Source" drop-down list and select "Authorization".
-Click “OK” to add.
+Click "OK" to add.
 
-Click on the "Source Type" drop-down list and select "Request Header".
 Click on the "Source" drop-down list and select "Content-Type".
-Click “OK” to add.
+Click on the "Source Type" drop-down list and select "Response Header".
+Click "OK" to add.
 Click "OK".
-Click "Apply" under the "Actions" pane.</fixtext><fix id="F-83385r4_fix" /><check system="C-76345r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Note: If SSL is installed on load balancer through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server ONLY receives traffic from the load balancer, the SSL requirement must be met on the load balancer.
-Access the IIS 8.5 web server IIS Manager.
+Click "Apply" under the "Actions" pane.</fixtext><fix id="F-83385r6_fix" /><check system="C-76345r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Access the IIS 8.5 web server IIS Manager.
 Click the IIS 8.5 web server name.
 Under "IIS", double-click the "Logging" icon.
 Verify the "Format:" under "Log File" is configured to "W3C".
@@ -157,7 +155,7 @@ Under "Standard Fields", verify "User Agent", "User Name" and "Referrer" are sel
 Under "Custom Fields", verify the following field have been configured:
 Request Header &gt;&gt; Authorization
 Response Header &gt;&gt; Content-Type
-If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76695"><title>SRG-APP-000120-WSR-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91391r4_rule" severity="medium" weight="10.0"><version>IISW-SV-000115</version><title>The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion.</title><description>&lt;VulnDiscussion&gt;A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000162</ident><ident system="http://iase.disa.mil/cci">CCI-000163</ident><ident system="http://iase.disa.mil/cci">CCI-000164</ident><fixtext fixref="F-83391r2_fix">Open the IIS 8.5 Manager.
+If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76695"><title>SRG-APP-000120-WSR-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91391r5_rule" severity="medium" weight="10.0"><version>IISW-SV-000115</version><title>The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion.</title><description>&lt;VulnDiscussion&gt;A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000162</ident><ident system="http://iase.disa.mil/cci">CCI-000163</ident><ident system="http://iase.disa.mil/cci">CCI-000164</ident><fixtext fixref="F-83391r2_fix">Open the IIS 8.5 Manager.
 
 Click the IIS 8.5 web server name.
 
@@ -173,8 +171,8 @@ Set the log file permissions for the appropriate group(s).
 
 Click "OK".
 
-Select "Apply" in the "Actions" pane.   
-</fixtext><fix id="F-83391r2_fix" /><check system="C-76351r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
+Select "Apply" in the "Actions" pane.
+</fixtext><fix id="F-83391r2_fix" /><check system="C-76351r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
 Open the IIS 8.5 Manager.
 Click the IIS 8.5 web server name.
 Click the "Logging" icon.
@@ -183,10 +181,9 @@ Right-click the log file name to review.
 Click “Properties”.
 Click the “Security” tab.
 Verify log file access is restricted as follows. Otherwise, this is a finding.
-Eventlog - Full Control
+
 SYSTEM - Full Control
-Administrators - Full Control
-Web Managers - Read</check-content></check></Rule></Group><Group id="V-76697"><title>SRG-APP-000125-WSR-000071</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91393r2_rule" severity="medium" weight="10.0"><version>IISW-SV-000116</version><title>The log data and records from the IIS 8.5 web server must be backed up onto a different system or media.</title><description>&lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system or onto separate media than the system the web server is actually running on helps to assure that, in the event of a catastrophic system failure, the log records will be retained.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001348</ident><fixtext fixref="F-83393r1_fix">Configure system backups to include the directory paths of all IIS 8.5 web server and website log files.</fixtext><fix id="F-83393r1_fix" /><check system="C-76353r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>The IIS 8.5 web server and website log files should be backed up by the system backup.
+Administrators - Full Control</check-content></check></Rule></Group><Group id="V-76697"><title>SRG-APP-000125-WSR-000071</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91393r2_rule" severity="medium" weight="10.0"><version>IISW-SV-000116</version><title>The log data and records from the IIS 8.5 web server must be backed up onto a different system or media.</title><description>&lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system or onto separate media than the system the web server is actually running on helps to assure that, in the event of a catastrophic system failure, the log records will be retained.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001348</ident><fixtext fixref="F-83393r1_fix">Configure system backups to include the directory paths of all IIS 8.5 web server and website log files.</fixtext><fix id="F-83393r1_fix" /><check system="C-76353r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>The IIS 8.5 web server and website log files should be backed up by the system backup.
 
 To determine if log files are backed up by the system backup, determine the location of the web server log files and each website's log files.
 
@@ -360,7 +357,7 @@ Source code for a Java program is, many times, stored in files with either .java
 
 If files with .java or .jpp extensions are found, this is a finding.</check-content></check></Rule></Group><Group id="V-76719"><title>SRG-APP-000211-WSR-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91415r1_rule" severity="high" weight="10.0"><version>IISW-SV-000131</version><title>IIS 8.5 Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.</title><description>&lt;VulnDiscussion&gt;As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001082</ident><fixtext fixref="F-83415r1_fix">Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities.
 
-All non-administrator access to shell scripts and operating system functions must be mission essential and documented.</fixtext><fix id="F-83415r1_fix" /><check system="C-76375r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Obtain a list of the user accounts with access to the system, including all local and domain accounts. 
+All non-administrator access to shell scripts and operating system functions must be mission essential and documented.</fixtext><fix id="F-83415r1_fix" /><check system="C-76375r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Obtain a list of the user accounts with access to the system, including all local and domain accounts.
 
 Review the privileges to the web server for each account.
 
@@ -391,7 +388,7 @@ Under "ASP.Net", double-click on the "Session State" icon.
 
 Under "Cookie Settings", select "Use Cookies” from the "Mode" drop-down list.
 
-Click "Apply" in the "Actions" pane. 
+Click "Apply" in the "Actions" pane.
 </fixtext><fix id="F-83421r3_fix" /><check system="C-76381r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
 Click the IIS 8.5 web server name.
 Under "ASP.Net", double-click on the "Session State" icon.
@@ -433,7 +430,7 @@ Double-click the "Machine Key" icon in the web server Home Pane.
 Set the Validation method to "HMACSHA256" or stronger.
 Set the Encryption method to "Auto".
 
-Click "Apply" in the "Actions" pane.   
+Click "Apply" in the "Actions" pane.
 </fixtext><fix id="F-83427r2_fix" /><check system="C-76387r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
 
 Click the IIS 8.5 web server name.
@@ -469,29 +466,29 @@ Access an administrator command prompt and type "regedit &lt;enter&gt;" to acces
 
 Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\.
 
-If this key exists, then indexing is enabled. 
+If this key exists, then indexing is enabled.
 
 If the key does not exist, this check is Not Applicable.
 
 Review the Catalog keys to determine if directories other than web document directories are being indexed.
 
-If so, this is a finding.</check-content></check></Rule></Group><Group id="V-76737"><title>SRG-APP-000266-WSR-000159</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91433r1_rule" severity="medium" weight="10.0"><version>IISW-SV-000140</version><title>Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 web server, patches, loaded modules, and directory paths.</title><description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-83433r1_fix">Open the IIS 8.5 Manager.
+If so, this is a finding.</check-content></check></Rule></Group><Group id="V-76737"><title>SRG-APP-000266-WSR-000159</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91433r2_rule" severity="medium" weight="10.0"><version>IISW-SV-000140</version><title>Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 web server, patches, loaded modules, and directory paths.</title><description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-83433r2_fix">Open the IIS 8.5 Manager.
 
 Click the IIS 8.5 web server name.
 
 Double-click the "Error Pages" icon.
 
-Click each error message and click "Edit Feature Setting" from the "Actions" Pane.
+Click on any error message and click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.
 
-Set each error message to “Detailed errors for local requests and custom error pages for remote requests”.</fixtext><fix id="F-83433r1_fix" /><check system="C-76393r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
+Set Feature Setting to “Detailed errors for local requests and custom error pages for remote requests”.</fixtext><fix id="F-83433r2_fix" /><check system="C-76393r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
 
 Click the IIS 8.5 web server name.
 
 Double-click the "Error Pages" icon.
 
-Click each error message and click "Edit Feature Setting" from the "Actions" Pane.
+Click on any error message and click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.
 
-If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</check-content></check></Rule></Group><Group id="V-76739"><title>SRG-APP-000315-WSR-000003</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91435r1_rule" severity="high" weight="10.0"><version>IISW-SV-000141</version><title>Remote access to the IIS 8.5 web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.</title><description>&lt;VulnDiscussion&gt;Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002314</ident><fixtext fixref="F-83435r1_fix">Ensure the web server administration is only performed over a secure path.</fixtext><fix id="F-83435r1_fix" /><check system="C-76395r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>If web administration is performed at the console, this check is Not Applicable.
+If the feature setting is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</check-content></check></Rule></Group><Group id="V-76739"><title>SRG-APP-000315-WSR-000003</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91435r1_rule" severity="high" weight="10.0"><version>IISW-SV-000141</version><title>Remote access to the IIS 8.5 web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.</title><description>&lt;VulnDiscussion&gt;Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002314</ident><fixtext fixref="F-83435r1_fix">Ensure the web server administration is only performed over a secure path.</fixtext><fix id="F-83435r1_fix" /><check system="C-76395r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>If web administration is performed at the console, this check is Not Applicable.
 
 If web administration is performed remotely the following checks will apply.
 
@@ -553,7 +550,7 @@ Determine the respective website for the application at risk of an attack.
 
 Access the IIS 8.5 web server IIS Manager.
 
-Select the respective website. 
+Select the respective website.
 
 In the "Actions" pane, under "Manage Website", click on "Stop".
 
@@ -581,33 +578,28 @@ If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS
 
 In the "Actions" pane, under "Manage Server", click on "Stop".
 
-If the web server is not capable of or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.</check-content></check></Rule></Group><Group id="V-76745"><title>SRG-APP-000340-WSR-000029</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91441r1_rule" severity="medium" weight="10.0"><version>IISW-SV-000144</version><title>IIS 8.5 web server system files must conform to minimum file permission requirements.</title><description>&lt;VulnDiscussion&gt;This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002235</ident><fixtext fixref="F-83441r1_fix">Open Explorer and navigate to the inetpub directory.
-
-Right-click inetpub and select “Properties”.
-
+If the web server is not capable of or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.</check-content></check></Rule></Group><Group id="V-76745"><title>SRG-APP-000340-WSR-000029</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91441r2_rule" severity="medium" weight="10.0"><version>IISW-SV-000144</version><title>IIS 8.5 web server system files must conform to minimum file permission requirements.</title><description>&lt;VulnDiscussion&gt;This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002235</ident><fixtext fixref="F-83441r2_fix">Open Explorer and navigate to the inetpub directory.
+Right-click "inetpub" and select "Properties".
 Click the "Security" tab.
-
-Set the following permissions: 
+Set the following permissions:
 
 SYSTEM: Full control
 Administrators: Full control
 TrustedInstaller: Full control
 ALL APPLICATION PACKAGES (built-in security group): Read and execute
 Users: Read and execute, list folder contents
-Creator/Owner: special permissions to subkeys</fixtext><fix id="F-83441r1_fix" /><check system="C-76401r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open Explorer and navigate to the inetpub directory.
-
-Right-click inetpub and select “Properties”.
-
+CREATOR OWNER: special permissions to subkeys</fixtext><fix id="F-83441r2_fix" /><check system="C-76401r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open Explorer and navigate to the inetpub directory.
+Right-click "inetpub" and select "Properties".
 Click the "Security" tab.
-
 Verify the permissions for the following users; if the permissions are less restrictive, this is a finding.
 
 System: Full control
 Administrators: Full control
 TrustedInstaller: Full control
 ALL APPLICATION PACKAGES (built-in security group): Read and execute
+ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute
 Users: Read and execute, list folder contents
-Creator/Owner: Special permissions to subkeys</check-content></check></Rule></Group><Group id="V-76747"><title>SRG-APP-000357-WSR-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91443r1_rule" severity="medium" weight="10.0"><version>IISW-SV-000145</version><title>The IIS 8.5 web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 web server.</title><description>&lt;VulnDiscussion&gt;In order to make certain that the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism needs to be able to allocate log record storage capacity.
+CREATOR OWNER: Full Control, Subfolders and files only</check-content></check></Rule></Group><Group id="V-76747"><title>SRG-APP-000357-WSR-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91443r1_rule" severity="medium" weight="10.0"><version>IISW-SV-000145</version><title>The IIS 8.5 web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 web server.</title><description>&lt;VulnDiscussion&gt;In order to make certain that the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism needs to be able to allocate log record storage capacity.
 
 The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-83443r1_fix">Open the IIS 8.5 Manager.
 
@@ -720,7 +712,7 @@ Verify, at a minimum, the following tuning settings in the registry.
 
 Access the IIS 8.5 web server registry.
 
-Verify the following keys are present and configured. The required setting depends upon the requirements of the application. 
+Verify the following keys are present and configured. The required setting depends upon the requirements of the application.
 
 Recommended settings are not provided as these settings have to be explicitly configured to show a conscientious tuning has been made.
 
@@ -763,7 +755,7 @@ Navigate to the following registry paths and configure the "DisabledByDefault" R
 
 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
 
-HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server 
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
 
 With a REG_DWORD value of "0" for "DisabledByDefault"
 
@@ -801,14 +793,7 @@ If any of the respective registry paths do not exist or are configured with the
 
 NIST SP 800-52 defines the approved TLS versions for government applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-83457r1_fix">Configure the web server to use an approved TLS version according to NIST SP 800-52 and to disable all non-approved versions.</fixtext><fix id="F-83457r1_fix" /><check system="C-76417r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Review the web server documentation and deployed configuration to determine which version of TLS is being used.
 
-If the TLS version is not TLS 1.1 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-76763"><title>SRG-APP-000456-WSR-000187</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91459r2_rule" severity="medium" weight="10.0"><version>IISW-SV-000155</version><title>The IIS 8.5 web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).</title><description>&lt;VulnDiscussion&gt;Several vulnerabilities are associated with older versions of web server software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining the web server at a current version makes the efforts of a malicious user more difficult.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002605</ident><fixtext fixref="F-83459r1_fix">Install the current version of the web server software and maintain appropriate service packs and patches.</fixtext><fix id="F-83459r1_fix" /><check system="C-76419r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Determine the most recent patch level of the IIS 8.5 software, as posted on the Microsoft website.
-
-Open the IIS 8.5 Manager.
-
-Click "Help", and select "About Internet Information Services".
-
-If the version is more than one version behind the most recent patch level, this is a finding.
-</check-content></check></Rule></Group><Group id="V-76765"><title>SRG-APP-000516-WSR-000079</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91461r1_rule" severity="high" weight="10.0"><version>IISW-SV-000156</version><title>All accounts installed with the IIS 8.5 web server software and tools must have passwords assigned and default passwords changed.</title><description>&lt;VulnDiscussion&gt;During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community.
+If the TLS version is not TLS 1.1 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-76765"><title>SRG-APP-000516-WSR-000079</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91461r1_rule" severity="high" weight="10.0"><version>IISW-SV-000156</version><title>All accounts installed with the IIS 8.5 web server software and tools must have passwords assigned and default passwords changed.</title><description>&lt;VulnDiscussion&gt;During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community.
 
 The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.
 
@@ -826,7 +811,7 @@ Access Apps menu. Under Administrative Tools, select Computer Management.
 
 In left pane, expand "Local Users and Groups" and click on "Users".
 
-Review the local users listed in the middle pane. 
+Review the local users listed in the middle pane.
 
 If any local accounts are present and are used by IIS 8.5 verify with System Administrator that default passwords have been changed.
 
@@ -856,19 +841,39 @@ Click “Edit Feature Settings".
 
 Verify the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are NOT checked.
 
-If either or both of the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76771"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91467r2_rule" severity="medium" weight="10.0"><version>IISW-SV-000159</version><title>The IIS 8.5 web server must have a global authorization rule configured to restrict access.</title><description>&lt;VulnDiscussion&gt;Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83467r2_fix">Open the IIS 8.5 Manager.
-
+If either or both of the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76771"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91467r3_rule" severity="medium" weight="10.0"><version>IISW-SV-000159</version><title>The IIS 8.5 web server must have a global authorization rule configured to restrict access.</title><description>&lt;VulnDiscussion&gt;Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83467r3_fix">Open the IIS 8.5 Manager.
+Click the IIS 8.5 web server name.
+Double-click the “Authorization Rules” icon.
+Remove all users other than “Administrator”.
+</fixtext><fix id="F-83467r3_fix" /><check system="C-76427r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
 Click the IIS 8.5 web server name.
-
 Double-click the “Authorization Rules” icon.
 
-Remove all users other than “Administrator”.   
+If any user other than “Administrator” is listed, this is a finding.
 
-</fixtext><fix id="F-83467r2_fix" /><check system="C-76427r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
+If .NET is not installed, this is Not Applicable.
+</check-content></check></Rule></Group><Group id="V-95633"><title>SRG-APP-000001-WSR-000001</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104771r1_rule" severity="medium" weight="10.0"><version>IISW-SV-000200</version><title>The IIS 8.5 MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.</title><description>&lt;VulnDiscussion&gt;Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Installation 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Installation 8.5</dc:subject><dc:identifier>2793</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-101299r1_fix">Access the IIS 8.5 IIS Manager.
 
-Click the IIS 8.5 web server name.
+Click the IIS 8.5 server.
 
-Double-click the “Authorization Rules” icon.
+Select "Configuration Editor" under the "Management" section.
 
-If any user other than “Administrator” is listed, this is a finding.
-</check-content></check></Rule></Group></Benchmark>
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
+
+Expand "siteDefaults".
+Expand "limits".
+
+Set the "maxconnections" parameter to a value greater than zero.</fixtext><fix id="F-101299r1_fix" /><check system="C-94461r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Server_STIG.xml" /><check-content>Access the IIS 8.5 IIS Manager.
+
+Click the IIS 8.5 server.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
+
+Expand "siteDefaults".
+Expand "limits".
+
+Review the results and verify the value is greater than zero for the "maxconnections" parameter.
+
+If the maxconnections parameter is set to zero, this is a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.log
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.log
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.xml
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R9_Manual-xccdf.xml
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R8_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R10_Manual-xccdf.log
similarity index 89%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R8_Manual-xccdf.log
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R10_Manual-xccdf.log
index 3a21ef363..2d16e557e 100644
--- a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R8_Manual-xccdf.log	
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R10_Manual-xccdf.log	
@@ -1 +1,2 @@
 V-76819::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length approved by the ISSO, this is a finding.
+V-76775::System Administrator::""
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R8_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R10_Manual-xccdf.xml
similarity index 74%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R8_Manual-xccdf.xml
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R10_Manual-xccdf.xml
index f5fba330d..a052067c6 100644
--- a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R8_Manual-xccdf.xml	
+++ b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R10_Manual-xccdf.xml	
@@ -1,1410 +1,1353 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="IIS_8-5_Site_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-06-28">accepted</status><title>IIS 8.5 Site Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 8 Benchmark Date: 26 Jul 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76795" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76831" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Group id="V-76775"><title>SRG-APP-000001-WSR-000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91471r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000201</version><title>The IIS 8.5 website session state must be enabled.</title><description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
-
-When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
-
-ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-83471r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Under the "ASP.NET" section, select "Session State".
-
-Under "Session State Mode Settings", verify the "In Process" mode is selected.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83471r1_fix" /><check system="C-76431r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Under the "ASP.NET" section, select "Session State".
-
-Under "Session State Mode Settings", verify the "In Process" mode is selected.
-
-If the "Session State Mode Settings" is set to "In Process", this is not a finding.
-
-Alternative method:
-
-Click the site name.
-
-Select "Configuration Editor" under the "Management" section.
-
-From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
-
-Verify the "mode" reflects "InProc".
-
-If the "mode" is not set to "InProc", this is a finding.</check-content></check></Rule></Group><Group id="V-76777"><title>SRG-APP-000001-WSR-000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91473r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000202</version><title>The IIS 8.5 website session state cookie settings must be configured to Use Cookies mode.</title><description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
-
-When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
-
-ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.
-
-Cookies associate session information with client information for the duration of a user’s connection to a website. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies because cookies do not require any redirection.
-&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-83473r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server: 
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Under the ASP.NET section, select "Session State".
-
-Under "Cookie Settings", select the "Use Cookies" from the "Mode:" drop-down list.
-
-Select "Apply" from the "Actions" pane.
-</fixtext><fix id="F-83473r2_fix" /><check system="C-76433r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-Open the IIS 8.5 Manager.
-Click the site name.
-Under the "ASP.NET" section, select "Session State".
-Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.
-If the "Use Cookies" mode is selected, this is not a finding.
-
-Alternative method:
-Click the site name.
-Select "Configuration Editor" under the "Management" section.
-From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
-Verify the "cookieless" is set to "UseCookies".
-If the "cookieless" is not set to "UseCookies", this is a finding.
-Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</check-content></check></Rule></Group><Group id="V-76779"><title>SRG-APP-000014-WSR-000006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91475r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000203</version><title>A private IIS 8.5 website must only accept Secure Socket Layer connections.</title><description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
-
-FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-83475r1_fix">Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Double-click the "SSL Settings" icon.
-
-Select "Require SSL" check box.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83475r1_fix" /><check system="C-76435r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
-
-Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-Click the site name.
-Double-click the "SSL Settings" icon.
-Verify "Require SSL" check box is selected.
-
-If the "Require SSL" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76781"><title>SRG-APP-000014-WSR-000006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91477r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000204</version><title>A public IIS 8.5 website must only accept Secure Socket Layer connections when authentication is required.</title><description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
-
-FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-83477r1_fix">Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Double-click the "SSL Settings" icon.
-
-Select "Require SSL" check box.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83477r1_fix" /><check system="C-76437r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Double-click the "SSL Settings" icon.
-
-Verify "Require SSL" check box is selected.
-
-If the "Require SSL" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76783"><title>SRG-APP-000092-WSR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91479r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000205</version><title>The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session.</title><description>&lt;VulnDiscussion&gt;Log files are a critical component to the successful management of an IS used within the DoD. By generating log files with useful information web administrators can leverage them in the event of a disaster, malicious attack, or other site-specific needs.
-
-Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety.
-
-Without sufficient information establishing when the log event occurred, investigation into the cause of event is severely hindered. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.
-
-Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001462</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><fixtext fixref="F-83479r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Click the "Logging" icon.
-
-Under Format select "W3C".
-
-Select the following fields: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83479r1_fix" /><check system="C-76439r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Click the "Logging" icon.
-
-Under Format select "W3C".
-
-Click “Select Fields”, verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
-
-If the "W3C" is not selected as the logging format OR any of the required fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76785"><title>SRG-APP-000092-WSR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91481r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000206</version><title>Both the log file and Event Tracing for Windows (ETW) for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.
-
-In IIS 8.5, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.
-
-Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000139</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><fixtext fixref="F-83481r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Click the "Logging" icon.
-
-Under Log Event Destination, select the "Both log file and ETW event" radio button.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83481r1_fix" /><check system="C-76441r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Click the "Logging" icon.
-
-Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.
-
-If the "Both log file and ETW event" radio button is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76787"><title>SRG-APP-000098-WSR-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91483r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000208</version><title>An IIS 8.5 website behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. 
-
-Ascertaining the correct source, e.g. source IP, of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the logable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.
-
-A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000133</ident><fixtext fixref="F-83483r1_fix">Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 8.5 web server transparently.</fixtext><fix id="F-83483r1_fix" /><check system="C-76443r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy.
-
-If the IIS 8.5 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Click the "Logging" icon.
-
-Click on "View log file" button.
-
-When log file is displaced, review source IP information in log entries and verify entries do not reflect the IP address of the proxy server.
-
-If the website is not behind a load balancer or proxy server, this is Not Applicable.
-
-If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
-
-If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</check-content></check></Rule></Group><Group id="V-76789"><title>SRG-APP-000099-WSR-000061</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91485r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000209</version><title>The IIS 8.5 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 website events.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
-
-Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the logable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.
-
-Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000134</ident><fixtext fixref="F-83485r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Select the website being reviewed.
-
-Under "IIS", double-click the "Logging" icon.
-
-Configure the "Format:" under "Log File" to "W3C".
-
-Select the "Fields" button.
-
-Under "Custom Fields", select the following fields:
-
-Request Header &gt;&gt; Connection
-
-Request Header &gt;&gt; Warning
-
-Click "OK".
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83485r2_fix" /><check system="C-76445r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Select the website being reviewed.
-
-Under "IIS", double-click the "Logging" icon.
-
-Verify the "Format:" under "Log File" is configured to "W3C".
-
-Select the "Fields" button.
-
-Under "Custom Fields", verify the following fields are selected:
-
-Request Header &gt;&gt; Connection
-
-Request Header &gt;&gt; Warning
-
-If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76791"><title>SRG-APP-000100-WSR-000064</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91487r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000210</version><title>The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
-
-Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
-
-Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001487</ident><fixtext fixref="F-83487r3_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access the IIS 8.5 web server IIS 8.5 Manager.
-
-Select the website being reviewed.
-
-Under "IIS", double-click the "Logging" icon.
-
-Configure the "Format:" under "Log File" to "W3C".
-
-Select the "Fields" button.
-
-Under "Standard Fields", select "User Agent", "User Name" and "Referrer".
-
-Under "Custom Fields", select the following fields:
-
-Request Header &gt;&gt; Authorization
-
-Response Header &gt;&gt; Content-Type
-
-Click "OK".
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83487r3_fix" /><check system="C-76447r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access the IIS 8.5 web server IIS 8.5 Manager.
-
-Under "IIS", double-click the "Logging" icon.
-
-Verify the "Format:" under "Log File" is configured to "W3C".
-
-Select the "Fields" button.
-
-Under "Standard Fields", verify "User Agent", "User Name" and "Referrer" are selected.
-
-Under "Custom Fields", verify the following fields have been configured: 
-
-Request Header &gt;&gt; Authorization
-
-Response Header &gt;&gt; Content-Type
-
-If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76795"><title>SRG-APP-000120-WSR-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91491r4_rule" severity="medium" weight="10.0"><version>IISW-SI-000213</version><title>The log information from the IIS 8.5 website must be protected from unauthorized modification or deletion.</title><description>&lt;VulnDiscussion&gt;A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000163</ident><ident system="http://iase.disa.mil/cci">CCI-000164</ident><fixtext fixref="F-83491r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Click the "Logging" icon.
-
-Click "Browse" and navigate to the directory where the log files are stored.
-
-Right-click the log file name to review and click “Properties”.
-
-Click the “Security” tab.
-
-Set the log file permissions for the appropriate group.</fixtext><fix id="F-83491r1_fix" /><check system="C-76451r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-Click the site name.
-Click the "Logging" icon.
-Click "Browse" and navigate to the directory where the log files are stored.
-Right-click the log file name to review and click “Properties”.
-Click the “Security” tab.
-Verify only authorized groups are listed, if others are listed, this is a finding.
-
-Note: The log file should be restricted as follows:
-Auditors - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
-Web Managers - Read</check-content></check></Rule></Group><Group id="V-76797"><title>SRG-APP-000141-WSR-000081</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91493r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000214</version><title>The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.</title><description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
-
-A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
-
-A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83493r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the IIS 8.5 site.
-
-Under IIS, double-click the “MIME Types” icon.
-
-From the "Group by:" drop-down list, select "Content Type".
-
-From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions:
-
-.exe
-.dll
-.com
-.bat
-.csh
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83493r1_fix" /><check system="C-76453r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the IIS 8.5 site.
-
-Under IIS, double-click the “MIME Types” icon.
-
-From the "Group by:" drop-down list, select "Content Type".
-
-From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
-
-.exe
-.dll
-.com
-.bat
-.csh
-
-If any OS shell MIME types are configured, this is a finding.</check-content></check></Rule></Group><Group id="V-76799"><title>SRG-APP-000141-WSR-000082</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91495r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000215</version><title>Mappings to unused and vulnerable scripts on the IIS 8.5 website must be removed.</title><description>&lt;VulnDiscussion&gt;IIS 8.5 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 8.5, “Request Filtering” and "Handler Mappings".
-
-For "Request Filtering", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83495r2_fix">Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click Request Filtering-&gt;File Name Extensions Tab-&gt;Deny File Name Extension.
-
-Add any script file extensions listed on the black list that are not listed.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83495r2_fix" /><check system="C-76455r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>For "Request Filtering", the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8.5. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click Request Filtering-&gt;File Name Extensions Tab.
-
-If any script file extensions from the black list are not denied, this is a finding.</check-content></check></Rule></Group><Group id="V-76801"><title>SRG-APP-000141-WSR-000083</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91497r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000216</version><title>The IIS 8.5 website must have resource mappings set to disable the serving of certain file types.</title><description>&lt;VulnDiscussion&gt;Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and to identify which file types are not to be delivered to a client.
-
-By not specifying which files can and which files cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc.
-
-The web server must only allow hosted application file types to be served to a user and all other types must be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83497r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server: 
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click "Request Filtering".
-
-For any file name extensions from the black list which have "Allowed" set to "True", remove the file name extension.
-
-Select "Deny File Name Extension" from the "Actions" pane.
-
-Add each file name extension from the black list.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83497r1_fix" /><check system="C-76457r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>For "Handler Mappings", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Handler Mappings" in IIS 8.5. "Handler Mappings" at the site level take precedence over "Handler Mappings" at the server level.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server: 
-
-Open the IIS 8.5 Manager.
-
-Double-click "Request Filtering". 
-
-If any file name extensions from the black list have "Allowed" set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76803"><title>SRG-APP-000141-WSR-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91499r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000217</version><title>The IIS 8.5 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.</title><description>&lt;VulnDiscussion&gt;A web server can be installed with functionality that, just by its nature, is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.
-
-WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83499r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access Server Manager on the IIS 8.5 website.
-
-Select the Local Server.
-
-Click on "Manage".
-
-Select "Add Roles and Features".
-
-Click "Next" on the "Before you begin" dialog box.
-
-Select "Role-based or feature-based installation" on the "Installation Type" dialog box and click on "Next".
-
-Select the IIS 8.5 web server on the "Server Selection" dialog box.
-
-From the "Windows Features" dialog box, navigate to "World Wide Web Services" &gt;&gt; "Common HTTP Features".
-
-De-select "WebDAV Publishing" and click "Next" to complete removing the WebDAV Publishing feature from the IIS 8.5 web server.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83499r1_fix" /><check system="C-76459r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Select the IIS 8.5 website.
-
-Review the features listed under the "IIS" section.
-
-If the "WebDAV Authoring Rules" icon exists, this is a finding.</check-content></check></Rule></Group><Group id="V-76805"><title>SRG-APP-000141-WSR-000086</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91501r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000218</version><title>The production website must configure the Global .NET Trust Level.</title><description>&lt;VulnDiscussion&gt;A web server may host too many applications. Each application will need certain system resources and privileged operations to operate correctly. An application's trust level determines the permissions granted by the ASP.NET Code Access Security (CAS) policy. An application with full trust permissions may access all resource types on a server and perform privileged operations, while applications running with partial trust have varying levels of operating permissions and access to resources. The CAS determines the permissions granted to the application on the server. Setting a level of trust compatible with the applications will limit the potential harm a compromised application could cause to a system. The web server must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation.
-
-Limiting the application will confine the potential harm a compromised application could cause to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83501r2_fix">Note: If the server being reviewed is a non-production website, this is Not Applicable.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the ".NET Trust Level" icon.
-
-Set the ".NET Trust Level" to Full or less and click “Apply”.
-
-Select "Apply" from the "Actions" pane.   
-</fixtext><fix id="F-83501r2_fix" /><check system="C-76461r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a non-production website, this is Not Applicable.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the ".NET Trust Level" icon.
-
-If the ".NET Trust Level" is not set to Full or less, this is a finding.
-</check-content></check></Rule></Group><Group id="V-76807"><title>SRG-APP-000142-WSR-000089</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91503r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000219</version><title>Each IIS 8.5 website must be assigned a default host header.</title><description>&lt;VulnDiscussion&gt;The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to utilize, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address.
-
-Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-83503r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Right-click on the site name under review.
-
-Select “Edit Bindings”.
-
-Assign hostname entries and unique IP addresses to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
-
-Click "OK".
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83503r2_fix" /><check system="C-76463r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Right-click on the site name under review.
-
-Select “Edit Bindings”.
-
-Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
-
-If both hostname entries and unique IP addresses are not configure to port 80 for HTTP and port 443 for HTTPS (or other approved and documented port), this is a finding.
-
-Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.</check-content></check></Rule></Group><Group id="V-76809"><title>SRG-APP-000172-WSR-000104</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91505r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000220</version><title>A private websites authentication mechanism must use client certificates to transmit session identifier to assure integrity.</title><description>&lt;VulnDiscussion&gt;A DoD private website must utilize PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites.
-
-Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000197</ident><ident system="http://iase.disa.mil/cci">CCI-001188</ident><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-83505r1_fix">Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Double-click the "SSL Settings" icon.
-
-Verify the "Clients Certificate Required" check box is selected.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83505r1_fix" /><check system="C-76465r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Double-click the "SSL Settings" icon.
-
-Verify the "Clients Certificate Required" check box is selected.
-
-If the "Clients Certificate Required" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76811"><title>SRG-APP-000211-WSR-000031</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91507r2_rule" severity="high" weight="10.0"><version>IISW-SI-000221</version><title>Anonymous IIS 8.5 website access accounts must be restricted.</title><description>&lt;VulnDiscussion&gt;Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001082</ident><fixtext fixref="F-83507r1_fix">Remove the Anonymous access account from all privileged accounts and all privileged groups.</fixtext><fix id="F-83507r1_fix" /><check system="C-76467r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Check the account used for anonymous access to the website.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-Open the IIS 8.5 Manager.
-
-Double-click "Authentication" in the IIS section of the website’s Home Pane.
-
-If Anonymous access is disabled, this is Not a Finding.
-
-If Anonymous access is enabled, click “Anonymous Authentication”.
-
-Click “Edit” in the "Actions" pane.
-
-If the “Specific user” radio button is enabled and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Note: account name.
-
-Check privileged groups that may allow the anonymous account inappropriate membership:
-Open “Server Manager” on the machine.
-
-Expand Configuration.
-
-Expand Local Users and Groups.
-
-Click “Groups”.
-
-Review members of any of the following privileged groups:
-
-Administrators
-Backup Operators
-Certificate Services (of any designation)
-Distributed COM Users
-Event Log Readers
-Network Configuration Operators
-Performance Log Users
-Performance Monitor Users
-Power Users
-Print Operators
-Remote Desktop Users
-Replicator
-Users
-
-Double-click each group and review its members.
-
-If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.</check-content></check></Rule></Group><Group id="V-76813"><title>SRG-APP-000224-WSR-000136</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91509r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000223</version><title>The IIS 8.5 website must generate unique session identifiers that cannot be reliably reproduced.</title><description>&lt;VulnDiscussion&gt;Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application.
-
-By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID.
-
-The session ID generator also needs to be a FIPS 140-2-approved generator.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001188</ident><fixtext fixref="F-83509r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Under the ASP.NET section, select "Session State".
-
-Under "Session State" Mode Settings, select the "In Process" mode.</fixtext><fix id="F-83509r1_fix" /><check system="C-76469r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Under the "ASP.NET" section, select "Session State".
-
-Under "Session State" Mode Settings, verify the "In Process" mode is selected.
-
-If the "In Process" mode is selected, this is not a finding.
-
-Alternative method:
-
-Click the site name.
-
-Select "Configuration Editor" under the "Management" section.
-
-From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
-
-Verify the "mode" reflects "InProc".
-
-If the "mode" is not set to "InProc", this is a finding.</check-content></check></Rule></Group><Group id="V-76815"><title>SRG-APP-000233-WSR-000146</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91511r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000224</version><title>The IIS 8.5 website document directory must be in a separate partition from the IIS 8.5 websites system files.</title><description>&lt;VulnDiscussion&gt;The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001084</ident><fixtext fixref="F-83511r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Click the “Advanced Settings” from the "Actions" pane.
-
-Change the Physical Path to the new partition and directory location.</fixtext><fix id="F-83511r1_fix" /><check system="C-76471r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Click the "Advanced Settings" from the "Actions" pane.
-
-Review the Physical Path.
-
-If the Path is on the same partition as the OS, this is a finding.</check-content></check></Rule></Group><Group id="V-76817"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91513r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000225</version><title>The IIS 8.5 website must be configured to limit the maxURL.</title><description>&lt;VulnDiscussion&gt;Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83513r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Click the site name under review.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-Set the "maxURL" value to "4096" or less.</fixtext><fix id="F-83513r1_fix" /><check system="C-76473r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the site name.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-If the "maxUrl" value is not set to "4096" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-76819"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91515r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000226</version><title>The IIS 8.5 website must be configured to limit the size of web requests.</title><description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83515r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-Set the "maxAllowedContentLength" value to "30000000" or less.</fixtext><fix id="F-83515r1_fix" /><check system="C-76475r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the site name.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.
-</check-content></check></Rule></Group><Group id="V-76821"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91517r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000227</version><title>The IIS 8.5 websites Maximum Query String limit must be configured.</title><description>&lt;VulnDiscussion&gt;By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83517r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-Set the "Maximum Query String" value to "2048" or less.</fixtext><fix id="F-83517r1_fix" /><check system="C-76477r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the site name.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-If the "Maximum Query String" value is not set to "2048" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-76823"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91519r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000228</version><title>Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83519r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-Uncheck the "Allow high-bit characters" check box.</fixtext><fix id="F-83519r1_fix" /><check system="C-76479r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the site name.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-If the "Allow high-bit characters" check box is checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76825"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91521r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000229</version><title>Double encoded URL requests must be prohibited by any IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the “Allow double escaping” option is disabled it prevents attacks that rely on double-encoded requests.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83521r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-Uncheck the "Allow double escaping" check box.</fixtext><fix id="F-83521r1_fix" /><check system="C-76481r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the site name.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-If the "Allow double escaping" check box is checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76827"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91523r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000230</version><title>Unlisted file extensions in URL requests must be filtered by any IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. By setting limits on web requests it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the “File Extensions Request” filter enables rejection of requests containing specific file extensions not defined in the “File Extensions” filter. Tripping this filter will cause IIS to generate a Status Code 404.7.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83523r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-Uncheck the "Allow unlisted file extensions" check box.</fixtext><fix id="F-83523r1_fix" /><check system="C-76483r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click on the site name.
-
-Double-click the "Request Filtering" icon.
-
-Click “Edit Feature Settings” in the "Actions" pane.
-
-If "Allow unlisted file name extensions" check box is checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76829"><title>SRG-APP-000251-WSR-000157</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91525r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000231</version><title>Directory Browsing on the IIS 8.5 website must be disabled.</title><description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001310</ident><fixtext fixref="F-83525r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the Site.
-
-Double-click the "Directory Browsing" icon.
-
-Under the "Actions" pane click "Disabled".</fixtext><fix id="F-83525r1_fix" /><check system="C-76485r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Click the Site.
-
-Double-click the "Directory Browsing" icon.
-
-If the "Directory Browsing" is not installed, this is Not Applicable.
-
-Under the "Actions" pane verify "Directory Browsing" is "Disabled".
-
-If "Directory Browsing" is not "Disabled", this is a finding.</check-content></check></Rule></Group><Group id="V-76831"><title>SRG-APP-000266-WSR-000142</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91527r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000232</version><title>The IIS 8.5 website must prevent a web content directory from being displayed.</title><description>&lt;VulnDiscussion&gt;The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-83527r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click "Default Document".
-
-In the “Actions” pane select "Enable".
-
-Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Create a valid document for the listed "Default Document".</fixtext><fix id="F-83527r1_fix" /><check system="C-76487r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: This requirement is only for each site's root directory.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Click the site name under review.
-
-Double-click "Default Document".
-
-In the "Actions" pane, verify the "Default Document" feature is enabled. 
-
-If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding.
-
-If "Default Document" is "Enabled, review the document types.
-
-Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory.
-
-If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.</check-content></check></Rule></Group><Group id="V-76835"><title>SRG-APP-000266-WSR-000159</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91531r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000233</version><title>Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 website, patches, loaded modules, and directory paths.</title><description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-83531r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the "Error Pages" icon.
-
-Click each error message and click "Edit Feature" Setting from the "Actions" pane; set each error message to “Detailed errors for local requests and custom error pages for remote requests”.</fixtext><fix id="F-83531r1_fix" /><check system="C-76491r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click the "Error Pages" icon.
-
-Click each error message and click "Edit Feature" setting from the "Actions" pane.
-
-If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</check-content></check></Rule></Group><Group id="V-76837"><title>SRG-APP-000266-WSR-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91533r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000234</version><title>Debugging and trace information used to diagnose the IIS 8.5 website must be disabled.</title><description>&lt;VulnDiscussion&gt;Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-83533r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click ".NET Compilation".
-
-Scroll down to the "Behavior" section and set the value for "Debug" to "False".</fixtext><fix id="F-83533r1_fix" /><check system="C-76493r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the ".NET feature" is not installed, this check is Not Applicable.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Double-click ".NET Compilation".
-
-Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False".
-
-If the "Debug" value is not set to "False", this is a finding.</check-content></check></Rule></Group><Group id="V-76839"><title>SRG-APP-000295-WSR-000012</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91535r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000235</version><title>The Idle Time-out monitor for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received.
-
-The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes.
-
-By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-83535r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the Application Pools.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Process Model" section and set the value for "Idle Time-out" to "20" or less.</fixtext><fix id="F-83535r1_fix" /><check system="C-76495r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the Application Pools.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is set to "20".
-
-If the "Idle Time-out" is not set to "20" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-76841"><title>SRG-APP-000295-WSR-000134</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91537r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000236</version><title>The IIS 8.5 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.</title><description>&lt;VulnDiscussion&gt;Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.
-
-Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-83537r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Select "Configuration Editor" under the "Management" section.
-
-From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". 
-
-Set the "timeout" to "00:20:00 or less”, using the lowest value possible depending upon the application.
-Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.
-
-In the "Actions" pane, click "Apply".  
-</fixtext><fix id="F-83537r2_fix" /><check system="C-76497r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Select "Configuration Editor" under the "Management" section.
-
-From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
-
-Verify the "timeout" is set to "00:20:00 or less”, using the lowest value possible depending upon the application.
-Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.
-
-If "timeout" is not set to "00:20:00 or less”, this is a finding.
-
-</check-content></check></Rule></Group><Group id="V-76843"><title>SRG-APP-000316-WSR-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91539r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000237</version><title>The IIS 8.5 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.</title><description>&lt;VulnDiscussion&gt;During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.
-
-The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.
-
-The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002322</ident><fixtext fixref="F-83539r1_fix">Prepare documented procedures for shutting down an IIS 8.5 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
-
-Determine the respective website for the application at risk of an attack.
-
-Access the IIS 8.5 web server IIS 8.5 Manager.
-
-Select the respective website.
-
-In the "Actions" pane, under "Manage Website", click on "Stop".
-
-If necessary, stop all websites.
-
-If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS 8.5 Manager.
-
-In the "Actions" pane, under "Manage Server", click on "Stop".</fixtext><fix id="F-83539r1_fix" /><check system="C-76499r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Interview the System Administrator and Web Manager.
-
-Ask for documentation for the IIS 8.5 web server administration.
-
-Verify there are documented procedures for shutting down an IIS 8.5 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
-
-Determine the respective website for the application at risk of an attack.
-
-Access the IIS 8.5 web server IIS 8.5 Manager.
-
-Select the respective website.
-
-In the "Actions" pane, under "Manage Website", click on "Stop".
-
-If necessary, stop all websites.
-
-If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS 8.5 Manager.
-
-In the "Actions" pane, under "Manage Server", click on "Stop".
-
-If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.</check-content></check></Rule></Group><Group id="V-76845"><title>SRG-APP-000357-WSR-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91541r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000238</version><title>The IIS 8.5 website must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;In order to make certain that the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism needs to be able to allocate log record storage capacity.
-
-The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-83541r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Under "IIS" double-click on the "Logging" icon.
-
-If necessary, in the "Logging" configuration box, redesignate a log path to a location able to house the logs.
-
-Under "Log File Rollover", deselect the "Do not create new log files" setting.
-
-Configure a schedule to rollover log files on a regular basis.</fixtext><fix id="F-83541r1_fix" /><check system="C-76501r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access the IIS 8.5 web server IIS 8.5 Manager.
-
-Under "IIS" double-click on the "Logging" icon.
-
-In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.
-
-Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.
-
-Under "Log File Rollover", verify the "Do not create new log files" is not selected.
-
-Verify a schedule is configured to rollover log files on a regular basis.
-
-Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 8.5 web server to another logging device.
-
-If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.</check-content></check></Rule></Group><Group id="V-76847"><title>SRG-APP-000383-WSR-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91543r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000239</version><title>The IIS 8.5 websites must utilize ports, protocols, and services according to PPSM guidelines.</title><description>&lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.
-
-The web server must provide the capability to disable or deactivate network-related services that are deemed to be non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.
-
-Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS.
-
-The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001762</ident><fixtext fixref="F-83543r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-In the “Action” Pane, click “Bindings".
-
-Edit to change an existing binding and set the correct ports and protocol.</fixtext><fix id="F-83543r1_fix" /><check system="C-76503r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-In the “Action” Pane, click “Bindings”.
-
-Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.</check-content></check></Rule></Group><Group id="V-76849"><title>SRG-APP-000427-WSR-000186</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91545r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000241</version><title>The IIS 8.5 private website have a server certificate issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).</title><description>&lt;VulnDiscussion&gt;The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-83545r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the Server name.
-
-Double-click “Server Certificates”.
-
-Click “Import” under the "Actions" pane.
-
-Browse to the DoD certificate location, select it, and click “OK”.
-
-Remove any non-DoD certificates if present.
-
-Click on the site needing the certificate.
-
-Select “Bindings” under the "Actions" pane.
-
-Click on the binding needing a certificate and select “Edit”, or add a site binding for HTTPS.
-
-Assign the certificate to the website by choosing it under the “SSL Certificate” drop-down and clicking “OK”.</fixtext><fix id="F-83545r1_fix" /><check system="C-76505r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Click “Bindings” in the “Action” Pane.
-
-Click the “HTTPS type” from the box.
-
-Click “Edit”.
-
-Click “View” and then review and verify the certificate path.
-
-If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding.
-
-If HTTPS is not an available type under site bindings, this is a finding.
-
-If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server, with IP address and Domain Restrictions in place, this is not a finding.</check-content></check></Rule></Group><Group id="V-76851"><title>SRG-APP-000429-WSR-000113</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91547r5_rule" severity="medium" weight="10.0"><version>IISW-SI-000242</version><title>The IIS 8.5 private website must employ cryptographic mechanisms (TLS) and require client certificates.</title><description>&lt;VulnDiscussion&gt;When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server.
-
-Preventing the disclosure of transmitted information requires that the web server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). 
-
-Transmission of data can take place between the web server and a large number of devices/applications external to the web server. Examples are a web client used by a user, a backend database, an audit server, or other web servers in a web cluster. 
-
-If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information.
-
-Also satisfies: SRG-APP-000439-WSR-000151&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002476</ident><fixtext fixref="F-83547r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Double-click the "SSL Settings" icon under the "IIS" section.
-
-Select the "Require SSL" setting.
-
-Select the "Client Certificates Required" setting.
-
-Click "Apply" in the "Actions" pane.
-
-Click the site under review.
-
-Select "Configuration Editor" under the "Management" section.
-
-From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”.
-
-Click on the drop-down list for "sslFlags".
-
-Select the "Ssl128" check box.
-
-Click "Apply" in the "Actions" pane.</fixtext><fix id="F-83547r1_fix" /><check system="C-76507r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-Double-click the "SSL Settings" icon under the "IIS" section.
-Verify "Require SSL" is checked.
-Verify "Client Certificates Required" is selected.
-Click the site under review.
-Select "Configuration Editor" under the "Management" section.
-From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”.
-The value for "sslFlags" set must include "ssl128".
-
-If the "Require SSL" is not selected, this is a finding.
-If the "Client Certificates Required" is not selected, this is a finding.
-If the "sslFlags" is not set to "ssl128", this is a finding.</check-content></check></Rule></Group><Group id="V-76855"><title>SRG-APP-000439-WSR-000152</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91551r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000244</version><title>IIS 8.5 website session IDs must be sent to the client using TLS.</title><description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data that is used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-83551r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access the IIS 8.5 Manager.
-
-Select the website being reviewed.
-
-Under "Management" section, double-click the "Configuration Editor" icon.
-
-From the "Section:" drop-down list, select “system.webServer/asp".
-
-Expand the "session" section.
-
-Select "True" for the "keepSessionIdSecure" setting.
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83551r1_fix" /><check system="C-76511r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access the IIS 8.5 Manager.
-
-Select the website being reviewed.
-
-Under "Management" section, double-click the "Configuration Editor" icon.
-
-From the "Section:" drop-down list, select “system.webServer/asp".
-
-Expand the "session" section.
-
-Verify the "keepSessionIdSecure" is set to "True".
-
-If the "keepSessionIdSecure" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76859"><title>SRG-APP-000439-WSR-000154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91555r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000246</version><title>Cookies exchanged between the IIS 8.5 website and the client must use SSL/TLS, have cookie properties set to prohibit client-side scripts from reading the cookie data and must not be compressed.</title><description>&lt;VulnDiscussion&gt;A cookie is used when a web server needs to share data with the client's browser. The data is often used to remember the client when the client returns to the hosted application at a later date. A session cookie is a special type of cookie used to remember the client during the session. The cookie will contain the session identifier (ID) and may contain authentication data to the hosted application. To protect this data from easily being compromised, the cookie must be encrypted. 
-
-When a cookie is sent encrypted via SSL/TLS, an attacker must spend a great deal of time and resources to decrypt the cookie. If, along with encryption, the cookie is compressed, the attacker can now use a combination of plaintext injection and inadvertent information leakage through data compression to reduce the time needed to decrypt the cookie. This attack is called Compression Ratio Info-leak Made Easy (CRIME). 
-
-Cookies shared between the web server and the client when encrypted should not also be compressed.
-
-A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e. HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.
-
-
-
-Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-83555r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access the IIS 8.5 Manager.
-
-Under "Management" section, double-click the "Configuration Editor" icon.
-
-From the "Section:" drop-down list, select "system.web/httpCookies".
-
-Set the "require SSL" to "True".
-
-From the "Section:" drop-down list, select "system.web/sessionState".
-
-Set the "compressionEnabled" to "False".
-
-Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83555r1_fix" /><check system="C-76515r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Access the IIS 8.5 Manager.
-
-Under "Management" section, double-click the "Configuration Editor" icon.
-
-From the "Section:" drop-down list, select "system.web/httpCookies".
-
-Verify the "require SSL" is set to "True".
-
-From the "Section:" drop-down list, select "system.web/sessionState".
-
-Verify the "compressionEnabled" is set to "False".
-
-If both the "system.web/httpCookies:require SSL" is set to "True" and the "system.web/sessionState:compressionEnabled" is set to "False", this is not a finding.</check-content></check></Rule></Group><Group id="V-76861"><title>SRG-APP-000441-WSR-000181</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91557r4_rule" severity="medium" weight="10.0"><version>IISW-SI-000249</version><title>The IIS 8.5 website must maintain the confidentiality and integrity of information during preparation for transmission and during reception.</title><description>&lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.
-
-An example of this would be an SMTP queue. This queue may be added to a web server through an SMTP module to enhance error reporting or to allow developers to add SMTP functionality to their applications. 
-
-Any modules used by the web server that queue data before transmission must maintain the confidentiality and integrity of the information before the data is transmitted.
-
-Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. 
-
-Protecting the confidentiality and integrity of received information requires that application servers take measures to employ approved cryptography in order to protect the information during transmission over the network. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPsec tunnel. 
-
-The web server must utilize approved encryption when receiving transmitted data.
-
-Also satisfies: SRG-APP-000442-WSR-000182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002420</ident><ident system="http://iase.disa.mil/cci">CCI-002422</ident><fixtext fixref="F-83557r2_fix">Follow the procedures below for web server and each site under review:
-
-Open the IIS 8.5 Manager.
-Click the site name.
-Double-click the "SSL Settings" icon.
-Select "Require SSL".
-Select "Client Certificates Required".
-Select “sslFlags”, and set to “ssl128”.</fixtext><fix id="F-83557r2_fix" /><check system="C-76517r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
-
-Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-Double-click the "SSL Settings" icon under the "IIS" section.
-Verify "Require SSL" is checked.
-Verify "Client Certificates Required" is selected.
-Click the site under review.
-Select "Configuration Editor" under the "Management" section.
-From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”.
-The value for "sslFlags" should be “ssl128”.
-
-If the "Require SSL" is not selected, this is a finding.
-If the "Client Certificates Required" is not selected, this is a finding.
-If the "sslFlags" is not set to "ssl128", this is a finding.</check-content></check></Rule></Group><Group id="V-76865"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91561r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000251</version><title>The IIS 8.5 website must have a unique application pool.</title><description>&lt;VulnDiscussion&gt;Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83561r1_fix">Open the IIS 8.5 Manager.
-
-Click the site name under review.
-
-Assign a unique application pool to each website.</fixtext><fix id="F-83561r1_fix" /><check system="C-76521r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
-
-Open the IIS 8.5 Manager.
-
-Click "Application Pools".
-
-In the list of Application Pools, review the "Applications" column and verify unique application pools for each website.
-
-If any Application Pools are being used for more than one website, this is a finding.</check-content></check></Rule></Group><Group id="V-76867"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91563r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000252</version><title>The maximum number of requests an application pool can process for each IIS 8.5 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83563r2_fix">Open the IIS 8.5 Manager.
-
-Click on the “Application Pools”.
-
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
-
-Scroll down to the "Recycling section" and set the value for "Request Limit" to greater than "0".
-
-Click “OK”.   
-</fixtext><fix id="F-83563r2_fix" /><check system="C-76523r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO, this check can be downgraded to a Cat III.
-
-Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
-
-Open the IIS 8.5 Manager.
-
-Perform for each Application Pool.
-
-Click the “Application Pools”.
-
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
-
-Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0".
-
-If the "Request Limit" is set to a value of "0", this is a finding.</check-content></check></Rule></Group><Group id="V-76869"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91565r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000253</version><title>The amount of virtual memory an application pool uses for each IIS 8.5 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83565r1_fix">Open the IIS 8.5 Manager.
-
-Click on “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
-
-In the "Advanced Settings" dialog box scroll down to the "Recycling" section and set the value for "Virtual Memory Limit" to a value other than "0".
-
-Click “OK”.</fixtext><fix id="F-83565r1_fix" /><check system="C-76525r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, mitigation steps can be set, to include setting the “Fixed number or requests”, “Specific time”, and “Private memory usage” in the recycling conditions lieu of the “Virtual memory” setting. If mitigation is used in lieu of this requirement, with supporting documentation from the ISSO, this check can be downgraded to a Cat III.
-
-Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
-
-Open the IIS 8.5 Manager.
-
-Perform for each Application Pool.
-
-Click on “Application Pools”.
-
-Highlight an Application Pool and click "Advanced Settings" in the Action Pane.
-
-In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to 0.
-
-If the value for "Virtual Memory Limit" is set to 0, this is a finding.</check-content></check></Rule></Group><Group id="V-76871"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91567r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000254</version><title>The amount of private memory an application pool uses for each IIS 8.5 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83567r1_fix">Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. 
-
-Scroll down to the "Recycling" section and set the value for "Private Memory Limit" to a value other than "0".</fixtext><fix id="F-83567r1_fix" /><check system="C-76527r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III.
-
-Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
-
-Open the IIS 8.5 Manager.
-
-Perform for each Application Pool.
-
-Click the “Application Pools”.
-
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
-
-Scroll down to the "Recycling" section and verify the value for "Private Memory Limit" is set to a value other than "0".
-
-If the "Private Memory Limit" is set to a value of "0", this is a finding.</check-content></check></Rule></Group><Group id="V-76873"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91569r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000255</version><title>The application pool for each IIS 8.5 website must have a recycle time explicitly set.</title><description>&lt;VulnDiscussion&gt;Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83569r1_fix">Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
-
-Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section.
-
-Set both the "Regular time interval" and "Specific time" options to "True".</fixtext><fix id="F-83569r1_fix" /><check system="C-76529r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III.
-
-Open the IIS 8.5 Manager.
-
-Perform for each Application Pool.
-
-Click the “Application Pools”.
-
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
-
-Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section.
-
-Verify both the "Regular time interval" and "Specific time" options are set to "True".
-
-If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76875"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91571r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000256</version><title>The maximum queue length for HTTP.sys for each IIS 8.5 website must be explicitly configured.</title><description>&lt;VulnDiscussion&gt;In order to determine the possible causes of client connection errors and to conserve system resources, it is important to both log errors and manage those settings controlling requests to the application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83571r1_fix">Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the “General” section and set the value for “Queue Length” to “1000” or less.
-
-Click “OK”.</fixtext><fix id="F-83571r1_fix" /><check system="C-76531r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
-
-Perform for each Application Pool.
-
-Click the “Application Pools”.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "General" section and verify the value for "Queue Length" is set to 1000.
-
-If the "Queue Length" is set to "1000" or less, this is not a finding.</check-content></check></Rule></Group><Group id="V-76877"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91573r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000257</version><title>The application pools pinging monitor for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83573r1_fix">Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Process Model" section and set the value for "Ping Enabled" to "True".
-
-Click “OK”.</fixtext><fix id="F-83573r1_fix" /><check system="C-76533r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the Internet Information Services (IIS) Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Process Model" section and verify the value for "Ping Enabled" is set to "True".
-
-If the value for "Ping Enabled" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76879"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91575r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000258</version><title>The application pools rapid fail protection for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83575r1_fix">Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Rapid Fail Protection" section and set the value for "Enabled" to "True".
-
-Click “OK”.</fixtext><fix id="F-83575r1_fix" /><check system="C-76535r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True".
-
-If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76881"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91577r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000259</version><title>The application pools rapid fail protection settings for each IIS 8.5 website must be managed.</title><description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83577r1_fix">Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Rapid Fail Protection" section and set the value for "Failure Interval" to "5" or less.
-
-Click “OK”.</fixtext><fix id="F-83577r1_fix" /><check system="C-76537r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
-
-Click the “Application Pools”.
-
-Perform for each Application Pool.
-
-Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
-Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5".
-
-If the "Failure Interval" is not set to "5" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-76885"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91581r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000261</version><title>Interactive scripts on the IIS 8.5 web server must be located in unique and designated folders.</title><description>&lt;VulnDiscussion&gt;CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the SA control over what goes into those folders and to facilitate access control at the folder level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83581r2_fix">All interactive programs must be placed in unique designated folders based on CGI or ASP script type.
-
-Open the IIS 8.5 Manager.
-
-Right-click the IIS 8.5 web server name and select Explore.
-
-Search for the listed script extensions.
-
-Move each script type to its unique designated folder.
-
-Set the permissions to the scripts folders as follows:
-
-Administrators: FULL
-TrustedInstaller: FULL
-SYSTEM: FULL
-ApplicationPoolId:READ
-Custom Service Account: READ
-Users: READ 
-ALL APPLICATION PACKAGES: READ  
-</fixtext><fix id="F-83581r2_fix" /><check system="C-76541r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp. 
-
-All interactive programs must be placed in unique designated folders based on CGI or ASP script type.
-
-Open the IIS 8.5 Manager.
-
-Right-click the IIS 8.5 web site name and select Explore.
-
-Search for the listed script extensions. Each script type must be in its unique designated folder.
-
-If scripts are not segregated from web content and in their own unique folders, then this is a finding.</check-content></check></Rule></Group><Group id="V-76887"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91583r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000262</version><title>Interactive scripts on the IIS 8.5 web server must have restrictive access controls.</title><description>&lt;VulnDiscussion&gt;CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension.
-
-The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the SA or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83583r1_fix">Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
-
-If the website does not utilize CGI, this finding is NA.
-
-All interactive programs must have restrictive permissions.
-
-Open the IIS 8.5 Manager.
-
-Right-click the IIS 8.5 web server name and select “Explore”.
-
-Search for the listed script extensions.
-
-Set the permissions to the CGI scripts as follows:
-
-Administrators: FULL
-TrustedInstaller: FULL
-ALL APPLICATION PACKAGES: Read
-SYSTEM: FULL
-ApplicationPoolId: READ
-Custom Service Account: READ
-Users: READ</fixtext><fix id="F-83583r1_fix" /><check system="C-76543r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
-
-If the website does not utilize CGI, this finding is Not Applicable.
-
-All interactive programs must have restrictive permissions.
-
-Open the IIS 8.5 Manager.
-
-Right-click the IIS 8.5 web site name and select “Explore”.
-
-Search for the listed script extensions.
-
-Review the permissions to the CGI scripts and verify only the permissions listed, or more restrictive permissions are assigned.
-
-Administrators: FULL
-TrustedInstaller: FULL
-ALL APPLICATION PACKAGES: Read
-SYSTEM: FULL
-ApplicationPoolId: READ
-Custom Service Account: READ
-Users: READ
-
-If the permissions are less restrictive than listed above, this is a finding.</check-content></check></Rule></Group><Group id="V-76889"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91585r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000263</version><title>Backup interactive scripts on the IIS 8.5 server must be removed.</title><description>&lt;VulnDiscussion&gt;Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83585r1_fix">Remove the backup files from the production web server.</fixtext><fix id="F-83585r1_fix" /><check system="C-76545r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
-
-If the website does not utilize CGI, this finding is Not Applicable.
-
-Open the IIS 8.5 Manager.
-
-Right-click the IIS 8.5 web site name and select “Explore”.
-
-Search for the listed script extensions
-
-Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.
-
-If files with these extensions are found, this is a finding.</check-content></check></Rule></Group><Group id="V-76891"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91587r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000264</version><title>The required DoD banner page must be displayed to authenticated users accessing a DoD private website.</title><description>&lt;VulnDiscussion&gt;A consent banner will be in place to make prospective entrants aware that the website they are about to enter is a DoD web site and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83587r1_fix">Configure a DoD private website to display the required DoD banner page when authentication is required for user access.</fixtext><fix id="F-83587r1_fix" /><check system="C-76547r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: This requirement is only applicable for private DoD websites.
-
-If a banner is required, the following banner page must be in place: 
-
-“You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. 
-
-By using this IS (which includes any device attached to this IS), you consent to the following conditions: 
-
--The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. 
-
-- At any time, the USG may inspect and seize data stored on this IS. 
-
-- Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. 
-
-- This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy. 
-
-- Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.” 
-
-OR 
-
-If your system cannot meet the character limits to store this amount of text in the banner, the following is another option for the warning banner: 
-
-"I've read &amp; consent to terms in IS user agreem't." 
-
-NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page. 
-
-If the access-controlled website does not display this banner page before entry, this is a finding.</check-content></check></Rule></Group></Benchmark>
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="IIS_8-5_Site_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-27">accepted</status><title>IIS 8.5 Site Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 10 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-76775" selected="true" /><select idref="V-76777" selected="true" /><select idref="V-76779" selected="true" /><select idref="V-76781" selected="true" /><select idref="V-76783" selected="true" /><select idref="V-76785" selected="true" /><select idref="V-76787" selected="true" /><select idref="V-76789" selected="true" /><select idref="V-76791" selected="true" /><select idref="V-76797" selected="true" /><select idref="V-76799" selected="true" /><select idref="V-76801" selected="true" /><select idref="V-76803" selected="true" /><select idref="V-76805" selected="true" /><select idref="V-76807" selected="true" /><select idref="V-76809" selected="true" /><select idref="V-76811" selected="true" /><select idref="V-76813" selected="true" /><select idref="V-76815" selected="true" /><select idref="V-76817" selected="true" /><select idref="V-76819" selected="true" /><select idref="V-76821" selected="true" /><select idref="V-76823" selected="true" /><select idref="V-76825" selected="true" /><select idref="V-76827" selected="true" /><select idref="V-76829" selected="true" /><select idref="V-76835" selected="true" /><select idref="V-76837" selected="true" /><select idref="V-76839" selected="true" /><select idref="V-76841" selected="true" /><select idref="V-76843" selected="true" /><select idref="V-76845" selected="true" /><select idref="V-76847" selected="true" /><select idref="V-76849" selected="true" /><select idref="V-76851" selected="true" /><select idref="V-76855" selected="true" /><select idref="V-76859" selected="true" /><select idref="V-76861" selected="true" /><select idref="V-76865" selected="true" /><select idref="V-76867" selected="true" /><select idref="V-76869" selected="true" /><select idref="V-76871" selected="true" /><select idref="V-76873" selected="true" /><select idref="V-76875" selected="true" /><select idref="V-76877" selected="true" /><select idref="V-76879" selected="true" /><select idref="V-76881" selected="true" /><select idref="V-76885" selected="true" /><select idref="V-76887" selected="true" /><select idref="V-76889" selected="true" /><select idref="V-76891" selected="true" /></Profile><Group id="V-76775"><title>SRG-APP-000001-WSR-000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91471r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000201</version><title>The IIS 8.5 website session state must be enabled.</title><description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
+
+When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
+
+ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-83471r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State Mode Settings", verify the "In Process" mode is selected.
+
+Select "Apply" from the "Actions" pane. </fixtext><fix id="F-83471r2_fix" /><check system="C-76431r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State Mode Settings", verify the "In Process" mode is selected.
+
+If the "Session State Mode Settings" is set to "In Process", this is not a finding.
+
+Alternative method:
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "mode" reflects "InProc".
+
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means.  If Session State Tracking is enabled on the Web Farm, this is not a finding.</check-content></check></Rule></Group><Group id="V-76777"><title>SRG-APP-000001-WSR-000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91473r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000202</version><title>The IIS 8.5 website session state cookie settings must be configured to Use Cookies mode.</title><description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
+
+When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
+
+ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.
+
+Cookies associate session information with client information for the duration of a user’s connection to a website. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies because cookies do not require any redirection.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-83473r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Under the ASP.NET section, select "Session State".
+
+Under "Cookie Settings", select the "Use Cookies" from the "Mode:" drop-down list.
+
+Select "Apply" from the "Actions" pane.
+</fixtext><fix id="F-83473r2_fix" /><check system="C-76433r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+Open the IIS 8.5 Manager.
+Click the site name.
+Under the "ASP.NET" section, select "Session State".
+Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.
+If the "Use Cookies" mode is selected, this is not a finding.
+
+Alternative method:
+Click the site name.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+Verify the "cookieless" is set to "UseCookies".
+If the "cookieless" is not set to "UseCookies", this is a finding.
+Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</check-content></check></Rule></Group><Group id="V-76779"><title>SRG-APP-000014-WSR-000006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91475r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000203</version><title>A private IIS 8.5 website must only accept Secure Socket Layer connections.</title><description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-83475r1_fix">Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Double-click the "SSL Settings" icon.
+
+Select "Require SSL" check box.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83475r1_fix" /><check system="C-76435r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
+
+Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Click the site name.
+Double-click the "SSL Settings" icon.
+Verify "Require SSL" check box is selected.
+
+If the "Require SSL" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76781"><title>SRG-APP-000014-WSR-000006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91477r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000204</version><title>A public IIS 8.5 website must only accept Secure Socket Layer connections when authentication is required.</title><description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000068</ident><fixtext fixref="F-83477r1_fix">Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Double-click the "SSL Settings" icon.
+
+Select "Require SSL" check box.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83477r1_fix" /><check system="C-76437r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Double-click the "SSL Settings" icon.
+
+Verify "Require SSL" check box is selected.
+
+If the "Require SSL" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76783"><title>SRG-APP-000092-WSR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91479r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000205</version><title>The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session.</title><description>&lt;VulnDiscussion&gt;Log files are a critical component to the successful management of an IS used within the DoD. By generating log files with useful information web administrators can leverage them in the event of a disaster, malicious attack, or other site-specific needs.
+
+Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety.
+
+Without sufficient information establishing when the log event occurred, investigation into the cause of event is severely hindered. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001462</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><fixtext fixref="F-83479r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Under Format select "W3C".
+
+Select the following fields: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83479r1_fix" /><check system="C-76439r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Under Format select "W3C".
+
+Click “Select Fields”, verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
+
+If the "W3C" is not selected as the logging format OR any of the required fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76785"><title>SRG-APP-000092-WSR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91481r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000206</version><title>Both the log file and Event Tracing for Windows (ETW) for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.
+
+In IIS 8.5, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000139</ident><ident system="http://iase.disa.mil/cci">CCI-001464</ident><fixtext fixref="F-83481r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, select the "Both log file and ETW event" radio button.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83481r1_fix" /><check system="C-76441r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.
+
+If the "Both log file and ETW event" radio button is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76787"><title>SRG-APP-000098-WSR-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91483r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000208</version><title>An IIS 8.5 website behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the correct source, e.g. source IP, of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the logable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.
+
+A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000133</ident><fixtext fixref="F-83483r1_fix">Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 8.5 web server transparently.</fixtext><fix id="F-83483r1_fix" /><check system="C-76443r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy.
+
+If the IIS 8.5 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Click on "View log file" button.
+
+When log file is displaced, review source IP information in log entries and verify entries do not reflect the IP address of the proxy server.
+
+If the website is not behind a load balancer or proxy server, this is Not Applicable.
+
+If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
+
+If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</check-content></check></Rule></Group><Group id="V-76789"><title>SRG-APP-000099-WSR-000061</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91485r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000209</version><title>The IIS 8.5 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 website events.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the logable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.
+
+Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000134</ident><fixtext fixref="F-83485r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Select the website being reviewed.
+
+Under "IIS", double-click the "Logging" icon.
+
+Configure the "Format:" under "Log File" to "W3C".
+
+Select the "Fields" button.
+
+Under "Custom Fields", select the following fields:
+
+Request Header &gt;&gt; Connection
+
+Request Header &gt;&gt; Warning
+
+Click "OK".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83485r2_fix" /><check system="C-76445r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Select the website being reviewed.
+
+Under "IIS", double-click the "Logging" icon.
+
+Verify the "Format:" under "Log File" is configured to "W3C".
+
+Select the "Fields" button.
+
+Under "Custom Fields", verify the following fields are selected:
+
+Request Header &gt;&gt; Connection
+
+Request Header &gt;&gt; Warning
+
+If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76791"><title>SRG-APP-000100-WSR-000064</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91487r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000210</version><title>The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.</title><description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
+
+Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001487</ident><fixtext fixref="F-83487r3_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Access the IIS 8.5 web server IIS 8.5 Manager.
+
+Select the website being reviewed.
+
+Under "IIS", double-click the "Logging" icon.
+
+Configure the "Format:" under "Log File" to "W3C".
+
+Select the "Fields" button.
+
+Under "Standard Fields", select "User Agent", "User Name" and "Referrer".
+
+Under "Custom Fields", select the following fields:
+
+Request Header &gt;&gt; Authorization
+
+Response Header &gt;&gt; Content-Type
+
+Click "OK".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83487r3_fix" /><check system="C-76447r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Access the IIS 8.5 web server IIS 8.5 Manager.
+
+Under "IIS", double-click the "Logging" icon.
+
+Verify the "Format:" under "Log File" is configured to "W3C".
+
+Select the "Fields" button.
+
+Under "Standard Fields", verify "User Agent", "User Name" and "Referrer" are selected.
+
+Under "Custom Fields", verify the following fields have been configured:
+
+Request Header &gt;&gt; Authorization
+
+Response Header &gt;&gt; Content-Type
+
+If any of the above fields are not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76797"><title>SRG-APP-000141-WSR-000081</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91493r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000214</version><title>The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.</title><description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
+
+A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83493r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the IIS 8.5 site.
+
+Under IIS, double-click the “MIME Types” icon.
+
+From the "Group by:" drop-down list, select "Content Type".
+
+From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions:
+
+.exe
+.dll
+.com
+.bat
+.csh
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83493r1_fix" /><check system="C-76453r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the IIS 8.5 site.
+
+Under IIS, double-click the “MIME Types” icon.
+
+From the "Group by:" drop-down list, select "Content Type".
+
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+
+.exe
+.dll
+.com
+.bat
+.csh
+
+If any OS shell MIME types are configured, this is a finding.</check-content></check></Rule></Group><Group id="V-76799"><title>SRG-APP-000141-WSR-000082</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91495r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000215</version><title>Mappings to unused and vulnerable scripts on the IIS 8.5 website must be removed.</title><description>&lt;VulnDiscussion&gt;IIS 8.5 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 8.5, “Request Filtering” and "Handler Mappings".
+
+For "Request Filtering", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83495r3_fix">Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click "Handler Mappings".
+
+Remove any script file extensions listed on the black list that are enabled.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83495r3_fix" /><check system="C-76455r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 8.5. Handler Mappings at the site level take precedence over Handler Mappings at the server level.
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click "Handler Mappings".
+
+If any script file extensions from the black list are enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-76801"><title>SRG-APP-000141-WSR-000083</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91497r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000216</version><title>The IIS 8.5 website must have resource mappings set to disable the serving of certain file types.</title><description>&lt;VulnDiscussion&gt;Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and to identify which file types are not to be delivered to a client.
+
+By not specifying which files can and which files cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc.
+
+The web server must only allow hosted application file types to be served to a user and all other types must be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83497r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Click the site name to review.
+Double-click Request Filtering &gt;&gt; File Name Extensions Tab &gt;&gt; Deny File Name Extension.
+Add any script file extensions listed on the black list that are not listed.
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83497r2_fix" /><check system="C-76457r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 8.5. Request Filtering at the site level take precedence over Request Filtering at the server level.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Click the site name to review.
+Double-click Request Filtering &gt;&gt; File Name Extensions Tab.
+
+If any script file extensions from the black list are not denied, this is a finding.</check-content></check></Rule></Group><Group id="V-76803"><title>SRG-APP-000141-WSR-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91499r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000217</version><title>The IIS 8.5 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.</title><description>&lt;VulnDiscussion&gt;A web server can be installed with functionality that, just by its nature, is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.
+
+WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83499r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Access Server Manager on the IIS 8.5 website.
+
+Select the Local Server.
+
+Click on "Manage".
+
+Select "Add Roles and Features".
+
+Click "Next" on the "Before you begin" dialog box.
+
+Select "Role-based or feature-based installation" on the "Installation Type" dialog box and click on "Next".
+
+Select the IIS 8.5 web server on the "Server Selection" dialog box.
+
+From the "Windows Features" dialog box, navigate to "World Wide Web Services" &gt;&gt; "Common HTTP Features".
+
+De-select "WebDAV Publishing" and click "Next" to complete removing the WebDAV Publishing feature from the IIS 8.5 web server.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83499r1_fix" /><check system="C-76459r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Select the IIS 8.5 website.
+
+Review the features listed under the "IIS" section.
+
+If the "WebDAV Authoring Rules" icon exists, this is a finding.</check-content></check></Rule></Group><Group id="V-76805"><title>SRG-APP-000141-WSR-000086</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91501r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000218</version><title>The production website must configure the Global .NET Trust Level.</title><description>&lt;VulnDiscussion&gt;A web server may host too many applications. Each application will need certain system resources and privileged operations to operate correctly. An application's trust level determines the permissions granted by the ASP.NET Code Access Security (CAS) policy. An application with full trust permissions may access all resource types on a server and perform privileged operations, while applications running with partial trust have varying levels of operating permissions and access to resources. The CAS determines the permissions granted to the application on the server. Setting a level of trust compatible with the applications will limit the potential harm a compromised application could cause to a system. The web server must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation.
+
+Limiting the application will confine the potential harm a compromised application could cause to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83501r2_fix">Note: If the server being reviewed is a non-production website, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the ".NET Trust Level" icon.
+
+Set the ".NET Trust Level" to Full or less and click “Apply”.
+
+Select "Apply" from the "Actions" pane.
+</fixtext><fix id="F-83501r2_fix" /><check system="C-76461r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a non-production website, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the ".NET Trust Level" icon.
+
+If the ".NET Trust Level" is not set to Full or less, this is a finding.
+</check-content></check></Rule></Group><Group id="V-76807"><title>SRG-APP-000142-WSR-000089</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91503r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000219</version><title>Each IIS 8.5 website must be assigned a default host header.</title><description>&lt;VulnDiscussion&gt;The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to utilize, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address.
+
+Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000382</ident><fixtext fixref="F-83503r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Right-click on the site name under review.
+
+Select “Edit Bindings”.
+
+Assign hostname entries and unique IP addresses to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
+
+Click "OK".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83503r2_fix" /><check system="C-76463r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Right-click on the site name under review.
+Select “Edit Bindings”.
+
+Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
+
+If both hostname entries and unique IP addresses are not configure to port 80 for HTTP and port 443 for HTTPS (or other approved and documented port), this is a finding.
+
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Note: If HTTP/Port 80 is not being used, and isn’t configured as above, this is not a finding.</check-content></check></Rule></Group><Group id="V-76809"><title>SRG-APP-000172-WSR-000104</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91505r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000220</version><title>A private websites authentication mechanism must use client certificates to transmit session identifier to assure integrity.</title><description>&lt;VulnDiscussion&gt;A DoD private website must utilize PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites.
+
+Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000197</ident><ident system="http://iase.disa.mil/cci">CCI-001188</ident><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-83505r3_fix">Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Double-click the "SSL Settings" icon.
+Verify the "Clients Certificate Required" check box is selected.
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83505r3_fix" /><check system="C-76465r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Double-click the "SSL Settings" icon.
+Verify the "Clients Certificate Required" check box is selected.
+
+If the "Clients Certificate Required" check box is not selected, this is a finding.</check-content></check></Rule></Group><Group id="V-76811"><title>SRG-APP-000211-WSR-000031</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91507r2_rule" severity="high" weight="10.0"><version>IISW-SI-000221</version><title>Anonymous IIS 8.5 website access accounts must be restricted.</title><description>&lt;VulnDiscussion&gt;Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001082</ident><fixtext fixref="F-83507r1_fix">Remove the Anonymous access account from all privileged accounts and all privileged groups.</fixtext><fix id="F-83507r1_fix" /><check system="C-76467r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Check the account used for anonymous access to the website.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+Open the IIS 8.5 Manager.
+
+Double-click "Authentication" in the IIS section of the website’s Home Pane.
+
+If Anonymous access is disabled, this is Not a Finding.
+
+If Anonymous access is enabled, click “Anonymous Authentication”.
+
+Click “Edit” in the "Actions" pane.
+
+If the “Specific user” radio button is enabled and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Note: account name.
+
+Check privileged groups that may allow the anonymous account inappropriate membership:
+Open “Server Manager” on the machine.
+
+Expand Configuration.
+
+Expand Local Users and Groups.
+
+Click “Groups”.
+
+Review members of any of the following privileged groups:
+
+Administrators
+Backup Operators
+Certificate Services (of any designation)
+Distributed COM Users
+Event Log Readers
+Network Configuration Operators
+Performance Log Users
+Performance Monitor Users
+Power Users
+Print Operators
+Remote Desktop Users
+Replicator
+Users
+
+Double-click each group and review its members.
+
+If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.</check-content></check></Rule></Group><Group id="V-76813"><title>SRG-APP-000224-WSR-000136</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91509r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000223</version><title>The IIS 8.5 website must generate unique session identifiers that cannot be reliably reproduced.</title><description>&lt;VulnDiscussion&gt;Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application.
+
+By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID.
+
+The session ID generator also needs to be a FIPS 140-2-approved generator.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001188</ident><fixtext fixref="F-83509r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Under the ASP.NET section, select "Session State".
+
+Under "Session State" Mode Settings, select the "In Process" mode.</fixtext><fix id="F-83509r2_fix" /><check system="C-76469r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State" Mode Settings, verify the "In Process" mode is selected.
+
+If the "In Process" mode is selected, this is not a finding.
+
+Alternative method:
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "mode" reflects "InProc".
+
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means.  If Session State Tracking is enabled on the Web Farm, this is not a finding.</check-content></check></Rule></Group><Group id="V-76815"><title>SRG-APP-000233-WSR-000146</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91511r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000224</version><title>The IIS 8.5 website document directory must be in a separate partition from the IIS 8.5 websites system files.</title><description>&lt;VulnDiscussion&gt;The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001084</ident><fixtext fixref="F-83511r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Click the “Advanced Settings” from the "Actions" pane.
+
+Change the Physical Path to the new partition and directory location.</fixtext><fix id="F-83511r1_fix" /><check system="C-76471r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Click the "Advanced Settings" from the "Actions" pane.
+
+Review the Physical Path.
+
+If the Path is on the same partition as the OS, this is a finding.</check-content></check></Rule></Group><Group id="V-76817"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91513r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000225</version><title>The IIS 8.5 website must be configured to limit the maxURL.</title><description>&lt;VulnDiscussion&gt;Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83513r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+Set the "maxURL" value to "4096" or less.</fixtext><fix id="F-83513r1_fix" /><check system="C-76473r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If the "maxUrl" value is not set to "4096" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-76819"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91515r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000226</version><title>The IIS 8.5 website must be configured to limit the size of web requests.</title><description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83515r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+Set the "maxAllowedContentLength" value to "30000000" or less.</fixtext><fix id="F-83515r1_fix" /><check system="C-76475r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.
+</check-content></check></Rule></Group><Group id="V-76821"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91517r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000227</version><title>The IIS 8.5 websites Maximum Query String limit must be configured.</title><description>&lt;VulnDiscussion&gt;By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83517r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+Set the "Maximum Query String" value to "2048" or less.</fixtext><fix id="F-83517r1_fix" /><check system="C-76477r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If the "Maximum Query String" value is not set to "2048" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-76823"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91519r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000228</version><title>Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83519r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+Uncheck the "Allow high-bit characters" check box.</fixtext><fix id="F-83519r1_fix" /><check system="C-76479r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If the "Allow high-bit characters" check box is checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76825"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91521r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000229</version><title>Double encoded URL requests must be prohibited by any IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the “Allow double escaping” option is disabled it prevents attacks that rely on double-encoded requests.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83521r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+Uncheck the "Allow double escaping" check box.</fixtext><fix id="F-83521r1_fix" /><check system="C-76481r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If the "Allow double escaping" check box is checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76827"><title>SRG-APP-000246-WSR-000149</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91523r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000230</version><title>Unlisted file extensions in URL requests must be filtered by any IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. By setting limits on web requests it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the “File Extensions Request” filter enables rejection of requests containing specific file extensions not defined in the “File Extensions” filter. Tripping this filter will cause IIS to generate a Status Code 404.7.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-83523r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+Uncheck the "Allow unlisted file extensions" check box.</fixtext><fix id="F-83523r1_fix" /><check system="C-76483r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If "Allow unlisted file name extensions" check box is checked, this is a finding.</check-content></check></Rule></Group><Group id="V-76829"><title>SRG-APP-000251-WSR-000157</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91525r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000231</version><title>Directory Browsing on the IIS 8.5 website must be disabled.</title><description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001310</ident><fixtext fixref="F-83525r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the Site.
+
+Double-click the "Directory Browsing" icon.
+
+Under the "Actions" pane click "Disabled".</fixtext><fix id="F-83525r1_fix" /><check system="C-76485r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Click the Site.
+
+Double-click the "Directory Browsing" icon.
+
+If the "Directory Browsing" is not installed, this is Not Applicable.
+
+Under the "Actions" pane verify "Directory Browsing" is "Disabled".
+
+If "Directory Browsing" is not "Disabled", this is a finding.</check-content></check></Rule></Group><Group id="V-76835"><title>SRG-APP-000266-WSR-000159</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91531r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000233</version><title>Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 website, patches, loaded modules, and directory paths.</title><description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-83531r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the "Error Pages" icon.
+
+Click each error message and click "Edit Feature" Setting from the "Actions" pane; set each error message to “Detailed errors for local requests and custom error pages for remote requests”.</fixtext><fix id="F-83531r1_fix" /><check system="C-76491r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click the "Error Pages" icon.
+
+Click each error message and click "Edit Feature" setting from the "Actions" pane.
+
+If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</check-content></check></Rule></Group><Group id="V-76837"><title>SRG-APP-000266-WSR-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91533r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000234</version><title>Debugging and trace information used to diagnose the IIS 8.5 website must be disabled.</title><description>&lt;VulnDiscussion&gt;Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001312</ident><fixtext fixref="F-83533r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click ".NET Compilation".
+
+Scroll down to the "Behavior" section and set the value for "Debug" to "False".</fixtext><fix id="F-83533r1_fix" /><check system="C-76493r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the ".NET feature" is not installed, this check is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Double-click ".NET Compilation".
+
+Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False".
+
+If the "Debug" value is not set to "False", this is a finding.</check-content></check></Rule></Group><Group id="V-76839"><title>SRG-APP-000295-WSR-000012</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91535r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000235</version><title>The Idle Time-out monitor for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received.
+
+The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes.
+
+By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-83535r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the Application Pools.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Process Model" section and set the value for "Idle Time-out" to "20" or less.</fixtext><fix id="F-83535r1_fix" /><check system="C-76495r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Click the Application Pools.
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is set to "20".
+
+If the "Idle Time-out" is not set to "20" or less, this is a finding.
+If the "Idle Time-out" is set to "0", this is a finding.</check-content></check></Rule></Group><Group id="V-76841"><title>SRG-APP-000295-WSR-000134</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91537r2_rule" severity="medium" weight="10.0"><version>IISW-SI-000236</version><title>The IIS 8.5 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.</title><description>&lt;VulnDiscussion&gt;Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.
+
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002361</ident><fixtext fixref="F-83537r2_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Set the "timeout" to "00:20:00 or less”, using the lowest value possible depending upon the application.
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.
+
+In the "Actions" pane, click "Apply".
+</fixtext><fix id="F-83537r2_fix" /><check system="C-76497r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "timeout" is set to "00:20:00 or less”, using the lowest value possible depending upon the application.
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.
+
+If "timeout" is not set to "00:20:00 or less”, this is a finding.
+
+</check-content></check></Rule></Group><Group id="V-76843"><title>SRG-APP-000316-WSR-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91539r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000237</version><title>The IIS 8.5 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.</title><description>&lt;VulnDiscussion&gt;During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.
+
+The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.
+
+The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002322</ident><fixtext fixref="F-83539r1_fix">Prepare documented procedures for shutting down an IIS 8.5 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 8.5 web server IIS 8.5 Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click on "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS 8.5 Manager.
+
+In the "Actions" pane, under "Manage Server", click on "Stop".</fixtext><fix id="F-83539r1_fix" /><check system="C-76499r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Interview the System Administrator and Web Manager.
+
+Ask for documentation for the IIS 8.5 web server administration.
+
+Verify there are documented procedures for shutting down an IIS 8.5 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 8.5 web server IIS 8.5 Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click on "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS 8.5 Manager.
+
+In the "Actions" pane, under "Manage Server", click on "Stop".
+
+If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.</check-content></check></Rule></Group><Group id="V-76845"><title>SRG-APP-000357-WSR-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91541r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000238</version><title>The IIS 8.5 website must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 website.</title><description>&lt;VulnDiscussion&gt;In order to make certain that the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism needs to be able to allocate log record storage capacity.
+
+The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001849</ident><fixtext fixref="F-83541r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Under "IIS" double-click on the "Logging" icon.
+
+If necessary, in the "Logging" configuration box, redesignate a log path to a location able to house the logs.
+
+Under "Log File Rollover", deselect the "Do not create new log files" setting.
+
+Configure a schedule to rollover log files on a regular basis.</fixtext><fix id="F-83541r1_fix" /><check system="C-76501r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Access the IIS 8.5 web server IIS 8.5 Manager.
+
+Under "IIS" double-click on the "Logging" icon.
+
+In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.
+
+Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.
+
+Under "Log File Rollover", verify the "Do not create new log files" is not selected.
+
+Verify a schedule is configured to rollover log files on a regular basis.
+
+Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 8.5 web server to another logging device.
+
+If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.</check-content></check></Rule></Group><Group id="V-76847"><title>SRG-APP-000383-WSR-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91543r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000239</version><title>The IIS 8.5 websites must utilize ports, protocols, and services according to PPSM guidelines.</title><description>&lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.
+
+The web server must provide the capability to disable or deactivate network-related services that are deemed to be non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.
+
+Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS.
+
+The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001762</ident><fixtext fixref="F-83543r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+In the “Action” Pane, click “Bindings".
+
+Edit to change an existing binding and set the correct ports and protocol.</fixtext><fix id="F-83543r1_fix" /><check system="C-76503r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+In the “Action” Pane, click “Bindings”.
+
+Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.</check-content></check></Rule></Group><Group id="V-76849"><title>SRG-APP-000427-WSR-000186</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91545r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000241</version><title>The IIS 8.5 private website have a server certificate issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).</title><description>&lt;VulnDiscussion&gt;The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002470</ident><fixtext fixref="F-83545r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the Server name.
+
+Double-click “Server Certificates”.
+
+Click “Import” under the "Actions" pane.
+
+Browse to the DoD certificate location, select it, and click “OK”.
+
+Remove any non-DoD certificates if present.
+
+Click on the site needing the certificate.
+
+Select “Bindings” under the "Actions" pane.
+
+Click on the binding needing a certificate and select “Edit”, or add a site binding for HTTPS.
+
+Assign the certificate to the website by choosing it under the “SSL Certificate” drop-down and clicking “OK”.</fixtext><fix id="F-83545r1_fix" /><check system="C-76505r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Click “Bindings” in the “Action” Pane.
+
+Click the “HTTPS type” from the box.
+
+Click “Edit”.
+
+Click “View” and then review and verify the certificate path.
+
+If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding.
+
+If HTTPS is not an available type under site bindings, this is a finding.
+
+If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server, with IP address and Domain Restrictions in place, this is not a finding.</check-content></check></Rule></Group><Group id="V-76851"><title>SRG-APP-000429-WSR-000113</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91547r5_rule" severity="medium" weight="10.0"><version>IISW-SI-000242</version><title>The IIS 8.5 private website must employ cryptographic mechanisms (TLS) and require client certificates.</title><description>&lt;VulnDiscussion&gt;When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server.
+
+Preventing the disclosure of transmitted information requires that the web server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS).
+
+Transmission of data can take place between the web server and a large number of devices/applications external to the web server. Examples are a web client used by a user, a backend database, an audit server, or other web servers in a web cluster.
+
+If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information.
+
+Also satisfies: SRG-APP-000439-WSR-000151&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002476</ident><fixtext fixref="F-83547r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Double-click the "SSL Settings" icon under the "IIS" section.
+
+Select the "Require SSL" setting.
+
+Select the "Client Certificates Required" setting.
+
+Click "Apply" in the "Actions" pane.
+
+Click the site under review.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”.
+
+Click on the drop-down list for "sslFlags".
+
+Select the "Ssl128" check box.
+
+Click "Apply" in the "Actions" pane.</fixtext><fix id="F-83547r1_fix" /><check system="C-76507r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Double-click the "SSL Settings" icon under the "IIS" section.
+Verify "Require SSL" is checked.
+Verify "Client Certificates Required" is selected.
+Click the site under review.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”.
+The value for "sslFlags" set must include "ssl128".
+
+If the "Require SSL" is not selected, this is a finding.
+If the "Client Certificates Required" is not selected, this is a finding.
+If the "sslFlags" is not set to "ssl128", this is a finding.</check-content></check></Rule></Group><Group id="V-76855"><title>SRG-APP-000439-WSR-000152</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91551r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000244</version><title>IIS 8.5 website session IDs must be sent to the client using TLS.</title><description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data that is used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-83551r1_fix">Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Access the IIS 8.5 Manager.
+
+Select the website being reviewed.
+
+Under "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select “system.webServer/asp".
+
+Expand the "session" section.
+
+Select "True" for the "keepSessionIdSecure" setting.
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83551r1_fix" /><check system="C-76511r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Access the IIS 8.5 Manager.
+
+Select the website being reviewed.
+
+Under "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select “system.webServer/asp".
+
+Expand the "session" section.
+
+Verify the "keepSessionIdSecure" is set to "True".
+
+If the "keepSessionIdSecure" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76859"><title>SRG-APP-000439-WSR-000154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91555r4_rule" severity="medium" weight="10.0"><version>IISW-SI-000246</version><title>Cookies exchanged between the IIS 8.5 website and the client must use SSL/TLS, have cookie properties set to prohibit client-side scripts from reading the cookie data and must not be compressed.</title><description>&lt;VulnDiscussion&gt;A cookie is used when a web server needs to share data with the client's browser. The data is often used to remember the client when the client returns to the hosted application at a later date. A session cookie is a special type of cookie used to remember the client during the session. The cookie will contain the session identifier (ID) and may contain authentication data to the hosted application. To protect this data from easily being compromised, the cookie must be encrypted.
+
+When a cookie is sent encrypted via SSL/TLS, an attacker must spend a great deal of time and resources to decrypt the cookie. If, along with encryption, the cookie is compressed, the attacker can now use a combination of plaintext injection and inadvertent information leakage through data compression to reduce the time needed to decrypt the cookie. This attack is called Compression Ratio Info-leak Made Easy (CRIME).
+
+Cookies shared between the web server and the client when encrypted should not also be compressed.
+
+A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e. HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.
+
+
+
+Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><fixtext fixref="F-83555r3_fix">Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+Under "Management" section, double-click the "Configuration Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+Under "Management" section, double-click the "Configuration Editor" icon.
+From the "Section:" drop-down list, select "system.web/httpCookies".
+Set the "require SSL" to "True".
+
+From the "Section:" drop-down list, select "system.web/sessionState".
+Set the "compressionEnabled" to "False".
+
+Select "Apply" from the "Actions" pane.</fixtext><fix id="F-83555r3_fix" /><check system="C-76515r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+Under the "Management" section, double-click the "Configuration Editor" icon.
+From the "Section:" drop-down list, select "system.web/httpCookies".
+Verify the "require SSL" is set to "True".
+
+From the "Section:" drop-down list, select "system.web/sessionState".
+Verify the "compressionEnabled" is set to "False".
+
+If both the "system.web/httpCookies:require SSL" is set to "True" and the "system.web/sessionState:compressionEnabled" is set to "False", this is not a finding.</check-content></check></Rule></Group><Group id="V-76861"><title>SRG-APP-000441-WSR-000181</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91557r5_rule" severity="medium" weight="10.0"><version>IISW-SI-000249</version><title>The IIS 8.5 website must maintain the confidentiality and integrity of information during preparation for transmission and during reception.</title><description>&lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.
+
+An example of this would be an SMTP queue. This queue may be added to a web server through an SMTP module to enhance error reporting or to allow developers to add SMTP functionality to their applications.
+
+Any modules used by the web server that queue data before transmission must maintain the confidentiality and integrity of the information before the data is transmitted.
+
+Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.
+
+Protecting the confidentiality and integrity of received information requires that application servers take measures to employ approved cryptography in order to protect the information during transmission over the network. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPsec tunnel.
+
+The web server must utilize approved encryption when receiving transmitted data.
+
+Also satisfies: SRG-APP-000442-WSR-000182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002420</ident><ident system="http://iase.disa.mil/cci">CCI-002422</ident><fixtext fixref="F-83557r4_fix">Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
+
+Follow the procedures below for web server and each site under review:
+
+Open the IIS 8.5 Manager.
+Double-click the "SSL Settings" icon under the "IIS" section.
+Verify "Require SSL" is checked.
+Verify "Client Certificates Required" is selected.
+Click the site under review.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”.
+The value for "sslFlags" should be “ssl128”.</fixtext><fix id="F-83557r4_fix" /><check system="C-76517r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
+
+Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+Double-click the "SSL Settings" icon under the "IIS" section.
+Verify "Require SSL" is checked.
+Verify "Client Certificates Required" is selected.
+Click the site under review.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”.
+The value for "sslFlags" should be “ssl128”.
+
+If the "Require SSL" is not selected, this is a finding.
+If the "Client Certificates Required" is not selected, this is a finding.
+If the "sslFlags" is not set to "ssl128", this is a finding.</check-content></check></Rule></Group><Group id="V-76865"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91561r4_rule" severity="medium" weight="10.0"><version>IISW-SI-000251</version><title>The IIS 8.5 website must have a unique application pool.</title><description>&lt;VulnDiscussion&gt;Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83561r2_fix">Open the IIS 8.5 Manager.
+
+Click the site name under review.
+
+Assign a unique application pool to each website.</fixtext><fix id="F-83561r2_fix" /><check system="C-76521r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 8.5 Manager.
+
+Click "Application Pools".
+
+In the list of Application Pools, review the "Applications" column and verify unique application pools for each website.
+
+If any Application Pools are being used for more than one website, this is a finding.</check-content></check></Rule></Group><Group id="V-76867"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91563r4_rule" severity="medium" weight="10.0"><version>IISW-SI-000252</version><title>The maximum number of requests an application pool can process for each IIS 8.5 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83563r3_fix">Open the IIS 8.5 Manager.
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling section" and set the value for "Request Limit" to greater than "0".
+
+Click "OK".</fixtext><fix id="F-83563r3_fix" /><check system="C-76523r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 8.5 Manager.
+
+Perform for each Application Pool.
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0".
+
+If the "Request Limit" is set to a value of "0", this is a finding.</check-content></check></Rule></Group><Group id="V-76869"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91565r4_rule" severity="medium" weight="10.0"><version>IISW-SI-000253</version><title>The amount of virtual memory an application pool uses for each IIS 8.5 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83565r2_fix">Open the IIS 8.5 Manager.
+
+Click “Application Pools”.
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+In the "Advanced Settings" dialog box scroll down to the "Recycling" section and set the value for "Virtual Memory Limit" to a value other than "0".
+
+Click "OK".</fixtext><fix id="F-83565r2_fix" /><check system="C-76525r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 8.5 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the Action Pane.
+
+In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to "0".
+
+If the value for "Virtual Memory Limit" is set to "0", this is a finding.</check-content></check></Rule></Group><Group id="V-76871"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91567r3_rule" severity="medium" weight="10.0"><version>IISW-SI-000254</version><title>The amount of private memory an application pool uses for each IIS 8.5 website must be explicitly set.</title><description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83567r2_fix">Open the IIS 8.5 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and set the value for "Private Memory Limit" to a value other than "0".</fixtext><fix id="F-83567r2_fix" /><check system="C-76527r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 8.5 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and verify the value for "Private Memory Limit" is set to a value other than "0".
+
+If the "Private Memory Limit" is set to a value of "0", this is a finding.</check-content></check></Rule></Group><Group id="V-76873"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91569r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000255</version><title>The application pool for each IIS 8.5 website must have a recycle time explicitly set.</title><description>&lt;VulnDiscussion&gt;Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83569r1_fix">Open the IIS 8.5 Manager.
+
+Click the “Application Pools”.
+
+Perform for each Application Pool.
+
+Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
+
+Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section.
+
+Set both the "Regular time interval" and "Specific time" options to "True".</fixtext><fix id="F-83569r1_fix" /><check system="C-76529r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III.
+
+Open the IIS 8.5 Manager.
+
+Perform for each Application Pool.
+
+Click the “Application Pools”.
+
+Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
+
+Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section.
+
+Verify both the "Regular time interval" and "Specific time" options are set to "True".
+
+If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76875"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91571r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000256</version><title>The maximum queue length for HTTP.sys for each IIS 8.5 website must be explicitly configured.</title><description>&lt;VulnDiscussion&gt;In order to determine the possible causes of client connection errors and to conserve system resources, it is important to both log errors and manage those settings controlling requests to the application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83571r1_fix">Open the IIS 8.5 Manager.
+
+Click the “Application Pools”.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the “General” section and set the value for “Queue Length” to “1000” or less.
+
+Click “OK”.</fixtext><fix id="F-83571r1_fix" /><check system="C-76531r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
+
+Perform for each Application Pool.
+
+Click the “Application Pools”.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "General" section and verify the value for "Queue Length" is set to 1000.
+
+If the "Queue Length" is set to "1000" or less, this is not a finding.</check-content></check></Rule></Group><Group id="V-76877"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91573r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000257</version><title>The application pools pinging monitor for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83573r1_fix">Open the IIS 8.5 Manager.
+
+Click the “Application Pools”.
+
+Perform for each Application Pool.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Process Model" section and set the value for "Ping Enabled" to "True".
+
+Click “OK”.</fixtext><fix id="F-83573r1_fix" /><check system="C-76533r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the Internet Information Services (IIS) Manager.
+
+Click the “Application Pools”.
+
+Perform for each Application Pool.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Process Model" section and verify the value for "Ping Enabled" is set to "True".
+
+If the value for "Ping Enabled" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76879"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91575r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000258</version><title>The application pools rapid fail protection for each IIS 8.5 website must be enabled.</title><description>&lt;VulnDiscussion&gt;Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83575r1_fix">Open the IIS 8.5 Manager.
+
+Click the “Application Pools”.
+
+Perform for each Application Pool.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and set the value for "Enabled" to "True".
+
+Click “OK”.</fixtext><fix id="F-83575r1_fix" /><check system="C-76535r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
+
+Click the “Application Pools”.
+
+Perform for each Application Pool.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True".
+
+If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.</check-content></check></Rule></Group><Group id="V-76881"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91577r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000259</version><title>The application pools rapid fail protection settings for each IIS 8.5 website must be managed.</title><description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83577r1_fix">Open the IIS 8.5 Manager.
+
+Click the “Application Pools”.
+
+Perform for each Application Pool.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and set the value for "Failure Interval" to "5" or less.
+
+Click “OK”.</fixtext><fix id="F-83577r1_fix" /><check system="C-76537r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Open the IIS 8.5 Manager.
+
+Click the “Application Pools”.
+
+Perform for each Application Pool.
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5".
+
+If the "Failure Interval" is not set to "5" or less, this is a finding.</check-content></check></Rule></Group><Group id="V-76885"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91581r4_rule" severity="medium" weight="10.0"><version>IISW-SI-000261</version><title>Interactive scripts on the IIS 8.5 web server must be located in unique and designated folders.</title><description>&lt;VulnDiscussion&gt;CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the SA control over what goes into those folders and to facilitate access control at the folder level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83581r3_fix">All interactive programs must be placed in unique designated folders based on CGI or ASP script type.
+
+Open the IIS 8.5 Manager.
+
+Right-click the IIS 8.5 web server name and select "Explore".
+
+Search for the listed script extensions.
+
+Move each script type to its unique designated folder.
+
+Set the permissions to the scripts folders as follows:
+
+Administrators: FULL
+TrustedInstaller: FULL
+SYSTEM: FULL
+ApplicationPoolId:READ
+Custom Service Account: READ
+Users: READ
+ALL APPLICATION PACKAGES: READ</fixtext><fix id="F-83581r3_fix" /><check system="C-76541r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp.
+
+All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders.
+
+Open the IIS 8.5 Manager.
+
+Right-click the IIS 8.5 web site name and select "Explore".
+
+Search for the listed script extensions. Each script type must be in its unique designated folder.
+
+If scripts are not segregated from web content and in their own unique folders, this is a finding.</check-content></check></Rule></Group><Group id="V-76887"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91583r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000262</version><title>Interactive scripts on the IIS 8.5 web server must have restrictive access controls.</title><description>&lt;VulnDiscussion&gt;CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension.
+
+The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the SA or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83583r1_fix">Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
+
+If the website does not utilize CGI, this finding is NA.
+
+All interactive programs must have restrictive permissions.
+
+Open the IIS 8.5 Manager.
+
+Right-click the IIS 8.5 web server name and select “Explore”.
+
+Search for the listed script extensions.
+
+Set the permissions to the CGI scripts as follows:
+
+Administrators: FULL
+TrustedInstaller: FULL
+ALL APPLICATION PACKAGES: Read
+SYSTEM: FULL
+ApplicationPoolId: READ
+Custom Service Account: READ
+Users: READ</fixtext><fix id="F-83583r1_fix" /><check system="C-76543r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
+
+If the website does not utilize CGI, this finding is Not Applicable.
+
+All interactive programs must have restrictive permissions.
+
+Open the IIS 8.5 Manager.
+
+Right-click the IIS 8.5 web site name and select “Explore”.
+
+Search for the listed script extensions.
+
+Review the permissions to the CGI scripts and verify only the permissions listed, or more restrictive permissions are assigned.
+
+Administrators: FULL
+TrustedInstaller: FULL
+ALL APPLICATION PACKAGES: Read
+SYSTEM: FULL
+ApplicationPoolId: READ
+Custom Service Account: READ
+Users: READ
+
+If the permissions are less restrictive than listed above, this is a finding.</check-content></check></Rule></Group><Group id="V-76889"><title>SRG-APP-000141-WSR-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91585r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000263</version><title>Backup interactive scripts on the IIS 8.5 server must be removed.</title><description>&lt;VulnDiscussion&gt;Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-83585r1_fix">Remove the backup files from the production web server.</fixtext><fix id="F-83585r1_fix" /><check system="C-76545r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
+
+If the website does not utilize CGI, this finding is Not Applicable.
+
+Open the IIS 8.5 Manager.
+
+Right-click the IIS 8.5 web site name and select “Explore”.
+
+Search for the listed script extensions
+
+Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.
+
+If files with these extensions are found, this is a finding.</check-content></check></Rule></Group><Group id="V-76891"><title>SRG-APP-000516-WSR-000174</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91587r1_rule" severity="medium" weight="10.0"><version>IISW-SI-000264</version><title>The required DoD banner page must be displayed to authenticated users accessing a DoD private website.</title><description>&lt;VulnDiscussion&gt;A consent banner will be in place to make prospective entrants aware that the website they are about to enter is a DoD web site and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target IIS Web Site 8.5</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>IIS Web Site 8.5</dc:subject><dc:identifier>2791</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83587r1_fix">Configure a DoD private website to display the required DoD banner page when authentication is required for user access.</fixtext><fix id="F-83587r1_fix" /><check system="C-76547r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_IIS_8-5_Site_STIG.xml" /><check-content>Note: This requirement is only applicable for private DoD websites.
+
+If a banner is required, the following banner page must be in place:
+
+“You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+- At any time, the USG may inspect and seize data stored on this IS.
+
+- Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+- This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy.
+
+- Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.”
+
+OR
+
+If your system cannot meet the character limits to store this amount of text in the banner, the following is another option for the warning banner:
+
+"I've read &amp; consent to terms in IS user agreem't."
+
+NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page.
+
+If the access-controlled website does not display this banner page before entry, this is a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.log
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.log
diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.xml
rename to source/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.log b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.log
similarity index 83%
rename from StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.log
index ff187abb7..2855e070b 100644
--- a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.log
+++ b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.log
@@ -4,4 +4,4 @@ V-68819::Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptB
 V-74413::Registry Path: \SOFTWARE\Policies\Microsoft\ Cryptography\Configuration\SSL\00010002\::Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002\
 V-74415::Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\ Privacy\::Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Privacy\
 V-63685::Registry Hive: HKEY_LOCAL_MACHINE::''
-V-94861::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\'; ValueData = $null; ValueName = 'MinimumPIN'; ValueType = 'DWord'; OrganizationValueTestString = 'ValueData is set to 0x00000006 (6) or greater '}
+V-94861::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE'; ValueData = $null; ValueName = 'MinimumPIN'; ValueType = 'DWord'; OrganizationValueTestString = 'ValueData is set to 0x00000006 (6) or greater '}
diff --git a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.xml b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.xml
diff --git a/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R21_Manual-xccdf.log b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R21_Manual-xccdf.log
new file mode 100644
index 000000000..39ecba29b
--- /dev/null
+++ b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R21_Manual-xccdf.log
@@ -0,0 +1,12 @@
+V-63423::"Minimum password length,"::"Minimum password length"
+V-63429::"Store password using reversible encryption"::"Store passwords using reversible encryption"
+V-68819::Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\::Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\
+V-74413::Registry Path: \SOFTWARE\Policies\Microsoft\ Cryptography\Configuration\SSL\00010002\::Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002\
+V-63685::Registry Hive: HKEY_LOCAL_MACHINE::''
+V-94861::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE'; ValueData = $null; ValueName = 'MinimumPIN'; ValueType = 'DWord'; OrganizationValueTestString = 'ValueData is set to 0x00000006 (6) or greater '}
+V-100093::RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam::Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam
+V-100093::This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.::ValueType: REG_SZ
+V-100093::This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.::Value: Deny
+V-100093::Value Name: Deny::ValueName: Value
+V-99561::Value data: 1::Value: 0x00000001 (1)
+V-99559::Value data: 0::Value: 0x00000000 (0)
diff --git a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R18_Manual-xccdf.xml b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R21_Manual-xccdf.xml
similarity index 76%
rename from StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R18_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R21_Manual-xccdf.xml
index 4ed85e716..6390965a2 100644
--- a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R18_Manual-xccdf.xml
+++ b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R21_Manual-xccdf.xml
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Windows_10_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-07-09">accepted</status><title>Windows 10 Security Technical Implementation Guide</title><description>The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en">Developed_by_DISA_for_the_DoD</notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 18 Benchmark Date: 26 Jul 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63441" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63455" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63475" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63495" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63705" selected="true" /><select idref="V-63707" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63723" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63763" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63887" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63891" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74415" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /></Profile><Group id="V-63319"><title>WN10-00-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77809r3_rule" severity="medium" weight="10.0"><version>WN10-00-000005</version><title>Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.</title><description>&lt;VulnDiscussion&gt;Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-69237r2_fix">Use Windows 10 Enterprise 64-bit version for domain-joined systems.</fixtext><fix id="F-69237r2_fix" /><check system="C-64053r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Windows_10_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-24">accepted</status><title>Windows 10 Security Technical Implementation Guide</title><description>The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en">Developed_by_DISA_for_the_DoD</notice><reference href="https://cyber.mil/"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 21 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-63319" selected="true" /><select idref="V-63321" selected="true" /><select idref="V-63323" selected="true" /><select idref="V-63325" selected="true" /><select idref="V-63329" selected="true" /><select idref="V-63333" selected="true" /><select idref="V-63335" selected="true" /><select idref="V-63337" selected="true" /><select idref="V-63339" selected="true" /><select idref="V-63341" selected="true" /><select idref="V-63343" selected="true" /><select idref="V-63345" selected="true" /><select idref="V-63347" selected="true" /><select idref="V-63349" selected="true" /><select idref="V-63351" selected="true" /><select idref="V-63353" selected="true" /><select idref="V-63355" selected="true" /><select idref="V-63357" selected="true" /><select idref="V-63359" selected="true" /><select idref="V-63361" selected="true" /><select idref="V-63363" selected="true" /><select idref="V-63365" selected="true" /><select idref="V-63367" selected="true" /><select idref="V-63369" selected="true" /><select idref="V-63371" selected="true" /><select idref="V-63373" selected="true" /><select idref="V-63375" selected="true" /><select idref="V-63377" selected="true" /><select idref="V-63381" selected="true" /><select idref="V-63383" selected="true" /><select idref="V-63385" selected="true" /><select idref="V-63389" selected="true" /><select idref="V-63393" selected="true" /><select idref="V-63399" selected="true" /><select idref="V-63403" selected="true" /><select idref="V-63405" selected="true" /><select idref="V-63409" selected="true" /><select idref="V-63413" selected="true" /><select idref="V-63415" selected="true" /><select idref="V-63419" selected="true" /><select idref="V-63421" selected="true" /><select idref="V-63423" selected="true" /><select idref="V-63427" selected="true" /><select idref="V-63429" selected="true" /><select idref="V-63431" selected="true" /><select idref="V-63435" selected="true" /><select idref="V-63445" selected="true" /><select idref="V-63447" selected="true" /><select idref="V-63449" selected="true" /><select idref="V-63451" selected="true" /><select idref="V-63453" selected="true" /><select idref="V-63457" selected="true" /><select idref="V-63459" selected="true" /><select idref="V-63463" selected="true" /><select idref="V-63467" selected="true" /><select idref="V-63469" selected="true" /><select idref="V-63471" selected="true" /><select idref="V-63473" selected="true" /><select idref="V-63479" selected="true" /><select idref="V-63481" selected="true" /><select idref="V-63483" selected="true" /><select idref="V-63487" selected="true" /><select idref="V-63491" selected="true" /><select idref="V-63499" selected="true" /><select idref="V-63503" selected="true" /><select idref="V-63507" selected="true" /><select idref="V-63513" selected="true" /><select idref="V-63515" selected="true" /><select idref="V-63517" selected="true" /><select idref="V-63519" selected="true" /><select idref="V-63523" selected="true" /><select idref="V-63527" selected="true" /><select idref="V-63533" selected="true" /><select idref="V-63537" selected="true" /><select idref="V-63541" selected="true" /><select idref="V-63545" selected="true" /><select idref="V-63549" selected="true" /><select idref="V-63555" selected="true" /><select idref="V-63559" selected="true" /><select idref="V-63563" selected="true" /><select idref="V-63567" selected="true" /><select idref="V-63569" selected="true" /><select idref="V-63577" selected="true" /><select idref="V-63579" selected="true" /><select idref="V-63581" selected="true" /><select idref="V-63583" selected="true" /><select idref="V-63585" selected="true" /><select idref="V-63587" selected="true" /><select idref="V-63589" selected="true" /><select idref="V-63591" selected="true" /><select idref="V-63593" selected="true" /><select idref="V-63595" selected="true" /><select idref="V-63597" selected="true" /><select idref="V-63599" selected="true" /><select idref="V-63601" selected="true" /><select idref="V-63607" selected="true" /><select idref="V-63609" selected="true" /><select idref="V-63611" selected="true" /><select idref="V-63615" selected="true" /><select idref="V-63617" selected="true" /><select idref="V-63619" selected="true" /><select idref="V-63621" selected="true" /><select idref="V-63623" selected="true" /><select idref="V-63625" selected="true" /><select idref="V-63627" selected="true" /><select idref="V-63629" selected="true" /><select idref="V-63633" selected="true" /><select idref="V-63635" selected="true" /><select idref="V-63639" selected="true" /><select idref="V-63643" selected="true" /><select idref="V-63645" selected="true" /><select idref="V-63647" selected="true" /><select idref="V-63649" selected="true" /><select idref="V-63651" selected="true" /><select idref="V-63653" selected="true" /><select idref="V-63657" selected="true" /><select idref="V-63659" selected="true" /><select idref="V-63661" selected="true" /><select idref="V-63663" selected="true" /><select idref="V-63665" selected="true" /><select idref="V-63667" selected="true" /><select idref="V-63669" selected="true" /><select idref="V-63671" selected="true" /><select idref="V-63673" selected="true" /><select idref="V-63675" selected="true" /><select idref="V-63677" selected="true" /><select idref="V-63679" selected="true" /><select idref="V-63681" selected="true" /><select idref="V-63683" selected="true" /><select idref="V-63685" selected="true" /><select idref="V-63687" selected="true" /><select idref="V-63689" selected="true" /><select idref="V-63691" selected="true" /><select idref="V-63695" selected="true" /><select idref="V-63697" selected="true" /><select idref="V-63699" selected="true" /><select idref="V-63701" selected="true" /><select idref="V-63703" selected="true" /><select idref="V-63709" selected="true" /><select idref="V-63711" selected="true" /><select idref="V-63713" selected="true" /><select idref="V-63717" selected="true" /><select idref="V-63719" selected="true" /><select idref="V-63721" selected="true" /><select idref="V-63729" selected="true" /><select idref="V-63731" selected="true" /><select idref="V-63733" selected="true" /><select idref="V-63737" selected="true" /><select idref="V-63739" selected="true" /><select idref="V-63741" selected="true" /><select idref="V-63743" selected="true" /><select idref="V-63745" selected="true" /><select idref="V-63747" selected="true" /><select idref="V-63749" selected="true" /><select idref="V-63751" selected="true" /><select idref="V-63755" selected="true" /><select idref="V-63759" selected="true" /><select idref="V-63765" selected="true" /><select idref="V-63767" selected="true" /><select idref="V-63795" selected="true" /><select idref="V-63797" selected="true" /><select idref="V-63801" selected="true" /><select idref="V-63803" selected="true" /><select idref="V-63805" selected="true" /><select idref="V-63807" selected="true" /><select idref="V-63811" selected="true" /><select idref="V-63815" selected="true" /><select idref="V-63817" selected="true" /><select idref="V-63819" selected="true" /><select idref="V-63821" selected="true" /><select idref="V-63825" selected="true" /><select idref="V-63827" selected="true" /><select idref="V-63829" selected="true" /><select idref="V-63831" selected="true" /><select idref="V-63839" selected="true" /><select idref="V-63841" selected="true" /><select idref="V-63843" selected="true" /><select idref="V-63845" selected="true" /><select idref="V-63847" selected="true" /><select idref="V-63851" selected="true" /><select idref="V-63853" selected="true" /><select idref="V-63855" selected="true" /><select idref="V-63857" selected="true" /><select idref="V-63859" selected="true" /><select idref="V-63861" selected="true" /><select idref="V-63863" selected="true" /><select idref="V-63865" selected="true" /><select idref="V-63869" selected="true" /><select idref="V-63871" selected="true" /><select idref="V-63873" selected="true" /><select idref="V-63875" selected="true" /><select idref="V-63877" selected="true" /><select idref="V-63879" selected="true" /><select idref="V-63881" selected="true" /><select idref="V-63883" selected="true" /><select idref="V-63889" selected="true" /><select idref="V-63917" selected="true" /><select idref="V-63925" selected="true" /><select idref="V-63927" selected="true" /><select idref="V-63931" selected="true" /><select idref="V-63933" selected="true" /><select idref="V-63935" selected="true" /><select idref="V-63939" selected="true" /><select idref="V-63941" selected="true" /><select idref="V-65681" selected="true" /><select idref="V-68817" selected="true" /><select idref="V-68819" selected="true" /><select idref="V-68845" selected="true" /><select idref="V-68849" selected="true" /><select idref="V-70637" selected="true" /><select idref="V-70639" selected="true" /><select idref="V-71759" selected="true" /><select idref="V-71761" selected="true" /><select idref="V-71763" selected="true" /><select idref="V-71765" selected="true" /><select idref="V-71769" selected="true" /><select idref="V-71771" selected="true" /><select idref="V-72329" selected="true" /><select idref="V-72765" selected="true" /><select idref="V-72767" selected="true" /><select idref="V-72769" selected="true" /><select idref="V-74409" selected="true" /><select idref="V-74411" selected="true" /><select idref="V-74413" selected="true" /><select idref="V-74417" selected="true" /><select idref="V-74699" selected="true" /><select idref="V-74719" selected="true" /><select idref="V-74721" selected="true" /><select idref="V-74723" selected="true" /><select idref="V-74725" selected="true" /><select idref="V-75027" selected="true" /><select idref="V-76505" selected="true" /><select idref="V-77083" selected="true" /><select idref="V-77085" selected="true" /><select idref="V-77091" selected="true" /><select idref="V-77095" selected="true" /><select idref="V-77097" selected="true" /><select idref="V-77101" selected="true" /><select idref="V-77103" selected="true" /><select idref="V-77189" selected="true" /><select idref="V-77191" selected="true" /><select idref="V-77195" selected="true" /><select idref="V-77201" selected="true" /><select idref="V-77205" selected="true" /><select idref="V-77209" selected="true" /><select idref="V-77213" selected="true" /><select idref="V-77217" selected="true" /><select idref="V-77221" selected="true" /><select idref="V-77223" selected="true" /><select idref="V-77227" selected="true" /><select idref="V-77231" selected="true" /><select idref="V-77233" selected="true" /><select idref="V-77235" selected="true" /><select idref="V-77239" selected="true" /><select idref="V-77243" selected="true" /><select idref="V-77245" selected="true" /><select idref="V-77247" selected="true" /><select idref="V-77249" selected="true" /><select idref="V-77255" selected="true" /><select idref="V-77259" selected="true" /><select idref="V-77263" selected="true" /><select idref="V-77267" selected="true" /><select idref="V-77269" selected="true" /><select idref="V-78129" selected="true" /><select idref="V-82137" selected="true" /><select idref="V-82139" selected="true" /><select idref="V-82145" selected="true" /><select idref="V-88203" selected="true" /><select idref="V-94719" selected="true" /><select idref="V-94859" selected="true" /><select idref="V-94861" selected="true" /><select idref="V-99541" selected="true" /><select idref="V-99543" selected="true" /><select idref="V-99545" selected="true" /><select idref="V-99547" selected="true" /><select idref="V-99549" selected="true" /><select idref="V-99551" selected="true" /><select idref="V-99553" selected="true" /><select idref="V-99555" selected="true" /><select idref="V-99557" selected="true" /><select idref="V-99559" selected="true" /><select idref="V-99561" selected="true" /><select idref="V-99563" selected="true" /><select idref="V-100093" selected="true" /></Profile><Group id="V-63319"><title>WN10-00-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77809r3_rule" severity="medium" weight="10.0"><version>WN10-00-000005</version><title>Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.</title><description>&lt;VulnDiscussion&gt;Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-69237r2_fix">Use Windows 10 Enterprise 64-bit version for domain-joined systems.</fixtext><fix id="F-69237r2_fix" /><check system="C-64053r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.
 
 For standalone systems, this is NA.
 
@@ -16,7 +16,7 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\
 Value Name: EnableUserControl
 
 Value Type: REG_DWORD
-Value: 0</check-content></check></Rule></Group><Group id="V-63323"><title>WN10-00-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77813r5_rule" severity="low" weight="10.0"><version>WN10-00-000010</version><title>Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.</title><description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-71517r1_fix">For standalone systems, this is NA.
+Value: 0</check-content></check></Rule></Group><Group id="V-63323"><title>WN10-00-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77813r6_rule" severity="medium" weight="10.0"><version>WN10-00-000010</version><title>Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.</title><description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-71517r1_fix">For standalone systems, this is NA.
 
 Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
 
@@ -25,7 +25,7 @@ For VDIs where the virtual desktop instance is deleted or refreshed upon logoff,
 Ensure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.)
 
 The TPM must be enabled in the firmware.
-Run "tpm.msc" for configuration options in Windows.</fixtext><fix id="F-71517r1_fix" /><check system="C-94059r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify domain-joined systems have a TPM enabled and ready for use.
+Run "tpm.msc" for configuration options in Windows.</fixtext><fix id="F-71517r1_fix" /><check system="C-94059r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify domain-joined systems have a TPM enabled and ready for use.
 
 For standalone systems, this is NA.
 
@@ -39,9 +39,7 @@ Review the sections in the center pane.
 "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken".
 TPM Manufacturer Information - Specific Version = 2.0 or 1.2
 
-If a TPM is not found or is not ready for use, this is a finding.
-
-NOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.</check-content></check></Rule></Group><Group id="V-63325"><title>WN10-CC-000315</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77815r1_rule" severity="high" weight="10.0"><version>WN10-CC-000315</version><title>The Windows Installer Always install with elevated privileges must be disabled.</title><description>&lt;VulnDiscussion&gt;Standard user accounts must not be granted elevated privileges.  Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001812</ident><fixtext fixref="F-69243r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Installer &gt;&gt; "Always install with elevated privileges" to "Disabled".</fixtext><fix id="F-69243r1_fix" /><check system="C-64059r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
+If a TPM is not found or is not ready for use, this is a finding.</check-content></check></Rule></Group><Group id="V-63325"><title>WN10-CC-000315</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77815r1_rule" severity="high" weight="10.0"><version>WN10-CC-000315</version><title>The Windows Installer Always install with elevated privileges must be disabled.</title><description>&lt;VulnDiscussion&gt;Standard user accounts must not be granted elevated privileges.  Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001812</ident><fixtext fixref="F-69243r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Installer &gt;&gt; "Always install with elevated privileges" to "Disabled".</fixtext><fix id="F-69243r1_fix" /><check system="C-64059r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
 
 Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\
@@ -103,7 +101,7 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\
 Value Name: AllowUnencryptedTraffic
 
 Value Type: REG_DWORD
-Value: 0</check-content></check></Rule></Group><Group id="V-63341"><title>WN10-CC-000340</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77831r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000340</version><title>The Windows Remote Management (WinRM) client must not use Digest authentication.</title><description>&lt;VulnDiscussion&gt;Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000877</ident><fixtext fixref="F-69263r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Client &gt;&gt; "Disallow Digest authentication" to "Enabled".</fixtext><fix id="F-69263r1_fix" /><check system="C-64079r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
+Value: 0</check-content></check></Rule></Group><Group id="V-63341"><title>WN10-CC-000360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77831r2_rule" severity="medium" weight="10.0"><version>WN10-CC-000360</version><title>The Windows Remote Management (WinRM) client must not use Digest authentication.</title><description>&lt;VulnDiscussion&gt;Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000877</ident><fixtext fixref="F-69263r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Client &gt;&gt; "Disallow Digest authentication" to "Enabled".</fixtext><fix id="F-69263r1_fix" /><check system="C-64079r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
 
 Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\
@@ -155,11 +153,11 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\
 Value Name: AllowBasic
 
 Value Type: REG_DWORD
-Value: 0</check-content></check></Rule></Group><Group id="V-63349"><title>WN10-00-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77839r9_rule" severity="high" weight="10.0"><version>WN10-00-000040</version><title>Windows 10 systems must be maintained at a supported servicing level.</title><description>&lt;VulnDiscussion&gt;Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation.
+Value: 0</check-content></check></Rule></Group><Group id="V-63349"><title>WN10-00-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77839r10_rule" severity="high" weight="10.0"><version>WN10-00-000040</version><title>Windows 10 systems must be maintained at a supported servicing level.</title><description>&lt;VulnDiscussion&gt;Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation.
 
 New versions with feature updates are planned to be released on a semi-annual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions.
 
-A separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-98031r2_fix">Update systems on the Semi-Annual Channel to "Microsoft Windows Version 1703 (OS Build 15063.0)" or greater.
+A separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-98031r3_fix">Update systems on the Semi-Annual Channel to "Microsoft Windows Version 1709 (OS Build 16299.0)" or greater.
 
 It is recommended systems be upgraded to the most recently released version.
 
@@ -167,11 +165,11 @@ Special purpose systems using the Long-Term Servicing Branch\Channel (LTSC\B) ma
 
 v1507 (Build 10240)
 v1607 (Build 14393)
-v1809 (Build 17763)</fixtext><fix id="F-98031r2_fix" /><check system="C-94063r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Run "winver.exe".
+v1809 (Build 17763)</fixtext><fix id="F-98031r3_fix" /><check system="C-94063r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Run "winver.exe".
 
 If the "About Windows" dialog box does not display:
 
-"Microsoft Windows Version 1703 (OS Build 15063.0)"
+"Microsoft Windows Version 1709 (OS Build 16299.0)"
 
 or greater, this is a finding.
 
@@ -562,17 +560,7 @@ Enter "AuditPol /get /category:*".
 
 Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
 
-Account Logon &gt;&gt; Credential Validation - Success</check-content></check></Rule></Group><Group id="V-63441"><title>WN10-AU-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77931r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000020</version><title>The system must be configured to audit Account Management - Other Account Management Events successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-Other Account Management records events such as the access of a password hash or the Password Policy Checking API being called.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><ident system="http://iase.disa.mil/cci">CCI-002234</ident><fixtext fixref="F-69369r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Account Management &gt;&gt; "Audit Other Account Management Events" with "Success" selected.</fixtext><fix id="F-69369r1_fix" /><check system="C-64189r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*".
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
-
-Account Management &gt;&gt; Other Account Management Events - Success</check-content></check></Rule></Group><Group id="V-63445"><title>WN10-AU-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77935r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000030</version><title>The system must be configured to audit Account Management - Security Group Management successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+Account Logon &gt;&gt; Credential Validation - Success</check-content></check></Rule></Group><Group id="V-63445"><title>WN10-AU-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77935r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000030</version><title>The system must be configured to audit Account Management - Security Group Management successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
 
 Security Group Management records events such as creating, deleting or changing of security groups, including changes in group members.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000018</ident><ident system="http://iase.disa.mil/cci">CCI-000172</ident><ident system="http://iase.disa.mil/cci">CCI-001403</ident><ident system="http://iase.disa.mil/cci">CCI-001404</ident><ident system="http://iase.disa.mil/cci">CCI-001405</ident><ident system="http://iase.disa.mil/cci">CCI-002130</ident><ident system="http://iase.disa.mil/cci">CCI-002234</ident><fixtext fixref="F-69373r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Account Management &gt;&gt; "Audit Security Group Management" with "Success" selected.</fixtext><fix id="F-69373r1_fix" /><check system="C-64193r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
 
@@ -622,17 +610,7 @@ Enter "AuditPol /get /category:*".
 
 Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
 
-Detailed Tracking &gt;&gt; Process Creation - Success</check-content></check></Rule></Group><Group id="V-63455"><title>WN10-AU-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77945r3_rule" severity="medium" weight="10.0"><version>WN10-AU-000055</version><title>The system must be configured to audit Logon/Logoff - Account Lockout successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-Account Lockout events can be used to identify potentially malicious logon attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-69383r3_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; "Audit Account Lockout" with "Success" selected.</fixtext><fix id="F-69383r3_fix" /><check system="C-64203r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*"
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
-
-Logon/Logoff &gt;&gt; Account Lockout - Success</check-content></check></Rule></Group><Group id="V-63457"><title>WN10-AU-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77947r2_rule" severity="medium" weight="10.0"><version>WN10-AU-000060</version><title>The system must be configured to audit Logon/Logoff - Group Membership successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+Detailed Tracking &gt;&gt; Process Creation - Success</check-content></check></Rule></Group><Group id="V-63457"><title>WN10-AU-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77947r2_rule" severity="medium" weight="10.0"><version>WN10-AU-000060</version><title>The system must be configured to audit Logon/Logoff - Group Membership successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
 
 Audit Group Membership records information related to the group membership of a user's logon token.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-69385r2_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; "Audit Group Membership" with "Success" selected.</fixtext><fix id="F-69385r2_fix" /><check system="C-64205r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
 
@@ -706,17 +684,7 @@ Compare the AuditPol settings with the following. If the system does not audit t
 
 Object Access &gt;&gt; Removable Storage - Success
 
-Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.</check-content></check></Rule></Group><Group id="V-63475"><title>WN10-AU-000095</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77965r2_rule" severity="medium" weight="10.0"><version>WN10-AU-000095</version><title>The system must be configured to audit Policy Change - Audit Policy Change failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-Audit Policy Change records events related to changes in audit policy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><ident system="http://iase.disa.mil/cci">CCI-002234</ident><fixtext fixref="F-69405r2_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; "Audit Audit Policy Change" with "Failure" selected.</fixtext><fix id="F-69405r2_fix" /><check system="C-64225r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*".
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
-
-Policy Change &gt;&gt; Audit Policy Change - Failure</check-content></check></Rule></Group><Group id="V-63479"><title>WN10-AU-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77969r2_rule" severity="medium" weight="10.0"><version>WN10-AU-000100</version><title>The system must be configured to audit Policy Change - Audit Policy Change successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.</check-content></check></Rule></Group><Group id="V-63479"><title>WN10-AU-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77969r2_rule" severity="medium" weight="10.0"><version>WN10-AU-000100</version><title>The system must be configured to audit Policy Change - Audit Policy Change successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
 
 Audit Policy Change records events related to changes in audit policy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-69409r2_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; "Audit Audit Policy Change" with "Success" selected.</fixtext><fix id="F-69409r2_fix" /><check system="C-64229r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
 
@@ -766,17 +734,7 @@ Enter "AuditPol /get /category:*".
 
 Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
 
-System &gt;&gt; IPSec Driver - Failure</check-content></check></Rule></Group><Group id="V-63495"><title>WN10-AU-000125</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77985r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000125</version><title>The system must be configured to audit System - IPSec Driver successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-IPSec Driver records events related to the IPSec Driver such as dropped packets.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-69425r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; "Audit IPSec Driver" with "Success" selected.</fixtext><fix id="F-69425r1_fix" /><check system="C-64245r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*".
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:"
-
-System &gt;&gt; IPSec Driver - Success</check-content></check></Rule></Group><Group id="V-63499"><title>WN10-AU-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77989r2_rule" severity="medium" weight="10.0"><version>WN10-AU-000130</version><title>The system must be configured to audit System - Other System Events successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+System &gt;&gt; IPSec Driver - Failure</check-content></check></Rule></Group><Group id="V-63499"><title>WN10-AU-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-77989r2_rule" severity="medium" weight="10.0"><version>WN10-AU-000130</version><title>The system must be configured to audit System - Other System Events successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
 
 Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000172</ident><fixtext fixref="F-69429r2_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; "Audit Other System Events" with "Success" selected.</fixtext><fix id="F-69429r2_fix" /><check system="C-64249r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
 
@@ -1183,7 +1141,7 @@ Issued To - Issued By - Thumbprint
 DoD Root CA 2 - DoD Interoperability Root CA 1 - 22BBE981F0694D246CC1472ED2B021DC8540A22F
 DoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341
 
-The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id="F-98441r3_fix" /><check system="C-91397r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.
+The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id="F-98441r3_fix" /><check system="C-91397r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.
 
 Run "PowerShell" as an administrator.
 
@@ -1193,7 +1151,7 @@ Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD
 
 If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+If an expired certificate ("NotAfter" date) is found, this is a finding.
 
 Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
 Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US
@@ -1246,7 +1204,7 @@ Valid to: Saturday, January 22, 2022</check-content></check></Rule></Group><Grou
 Issued To - Issued By - Thumbprint
 DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - 929BF3196896994C0A201DF4A5B71F603FEFBF2E
 
-The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id="F-98443r3_fix" /><check system="C-91399r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.
+The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id="F-98443r3_fix" /><check system="C-91399r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.
 
 Run "PowerShell" as an administrator.
 
@@ -1256,7 +1214,7 @@ Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Int
 
 If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+If an expired certificate ("NotAfter" date) is found, this is a finding.
 
 Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
 Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
@@ -1450,7 +1408,7 @@ Registry Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
 Value Name: LocalAccountTokenFilterPolicy
 
 Value Type: REG_DWORD
-Value: 0x00000000 (0)</check-content></check></Rule></Group><Group id="V-63599"><title>WN10-CC-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78089r8_rule" severity="low" weight="10.0"><version>WN10-CC-000075</version><title>Credential Guard must be running on Windows 10 domain-joined systems.</title><description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-88433r2_fix">Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
+Value: 0x00000000 (0)</check-content></check></Rule></Group><Group id="V-63599"><title>WN10-CC-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78089r9_rule" severity="high" weight="10.0"><version>WN10-CC-000075</version><title>Credential Guard must be running on Windows 10 domain-joined systems.</title><description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-88433r2_fix">Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
 
 For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
 
@@ -1462,11 +1420,9 @@ v1507 LTSB does not include selection options; select "Enable Credential Guard".
 
 A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link:
 
-https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard</fixtext><fix id="F-88433r2_fix" /><check system="C-94077r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Confirm Credential Guard is running on domain-joined systems.
-
-For standalone systems, this is NA.
+https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard</fixtext><fix id="F-88433r2_fix" /><check system="C-94077r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Confirm Credential Guard is running on domain-joined systems.
 
-For those devices that support Credential Guard, this feature must be enabled. For devices that do not support it, there is currently an enterprise risk acceptance in effect, thus this check is currently categorized as a CAT III. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.
+For those devices that support Credential Guard, this feature must be enabled. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.
 
 Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
 
@@ -1493,16 +1449,16 @@ Value Name: LsaCfgFlags
 Value Type: REG_DWORD
 Value: 0x00000001 (1) (Enabled with UEFI lock)
 
-NOTE:  The severity level for the requirement will be upgraded to CAT I starting January 2020.</check-content></check></Rule></Group><Group id="V-63601"><title>WN10-SO-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78091r1_rule" severity="medium" weight="10.0"><version>WN10-SO-000005</version><title>The built-in administrator account must be disabled.</title><description>&lt;VulnDiscussion&gt;The built-in administrator account is a well-known account subject to attack.  It also provides no accountability to individual administrators on a system.  It must be disabled to prevent its use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-69531r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; "Accounts: Administrator account status" to "Disabled".</fixtext><fix id="F-69531r1_fix" /><check system="C-64351r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the effective setting in Local Group Policy Editor.
+</check-content></check></Rule></Group><Group id="V-63601"><title>WN10-SO-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78091r1_rule" severity="medium" weight="10.0"><version>WN10-SO-000005</version><title>The built-in administrator account must be disabled.</title><description>&lt;VulnDiscussion&gt;The built-in administrator account is a well-known account subject to attack.  It also provides no accountability to individual administrators on a system.  It must be disabled to prevent its use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000764</ident><fixtext fixref="F-69531r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; "Accounts: Administrator account status" to "Disabled".</fixtext><fix id="F-69531r1_fix" /><check system="C-64351r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the effective setting in Local Group Policy Editor.
 Run "gpedit.msc".
 
 Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options.
 
-If the value for "Accounts: Administrator account status" is not set to "Disabled", this is a finding.</check-content></check></Rule></Group><Group id="V-63607"><title>WN10-CC-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78097r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000085</version><title>Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.</title><description>&lt;VulnDiscussion&gt;Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization.  The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application.  At a minimum, drivers determined to be bad must not be allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-69537r1_fix">The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad").
+If the value for "Accounts: Administrator account status" is not set to "Disabled", this is a finding.</check-content></check></Rule></Group><Group id="V-63607"><title>WN10-CC-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78097r2_rule" severity="medium" weight="10.0"><version>WN10-CC-000085</version><title>Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.</title><description>&lt;VulnDiscussion&gt;By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-69537r5_fix">Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce "Good, unknown and bad but critical" (preventing "bad").
 
-If this needs to be corrected or a more secure setting is desired, configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Early Launch Antimalware &gt;&gt; "Boot-Start Driver Initialization Policy" to "Not Configured" or "Enabled" with any option other than "All" selected.</fixtext><fix id="F-69537r1_fix" /><check system="C-64357r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad").
+If this needs to be corrected configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Early Launch Antimalware &gt;&gt; "Boot-Start Driver Initialization Policy" to "Enabled” with "Good, unknown and bad but critical" selected.</fixtext><fix id="F-69537r5_fix" /><check system="C-64357r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad").
 
-If the registry value name below does not exist, this is not a finding.
+If the registry value name below does not exist, this a finding.
 
 If it exists and is configured with a value of "7", this is a finding.
 
@@ -1512,13 +1468,14 @@ Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\
 Value Name: DriverLoadPolicy
 
 Value Type: REG_DWORD
-Value: 1, 3, or 8 (or if the Value Name does not exist)
+Value: 1, 3, or 8
 
 Possible values for this setting are:
 8 - Good only
 1 - Good and unknown
 3 - Good, unknown and bad but critical
-7 - All (which includes "Bad" and would be a finding)</check-content></check></Rule></Group><Group id="V-63609"><title>WN10-CC-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78099r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000090</version><title>Group Policy objects must be reprocessed even if they have not changed.</title><description>&lt;VulnDiscussion&gt;Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-69539r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Group Policy &gt;&gt; "Configure registry policy processing" to "Enabled" and select the option "Process even if the Group Policy objects have not changed".</fixtext><fix id="F-69539r1_fix" /><check system="C-64359r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
+7 - All (which includes "Bad" and would be a finding)
+</check-content></check></Rule></Group><Group id="V-63609"><title>WN10-CC-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78099r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000090</version><title>Group Policy objects must be reprocessed even if they have not changed.</title><description>&lt;VulnDiscussion&gt;Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-69539r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Group Policy &gt;&gt; "Configure registry policy processing" to "Enabled" and select the option "Process even if the Group Policy objects have not changed".</fixtext><fix id="F-69539r1_fix" /><check system="C-64359r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
 
 Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
@@ -2001,24 +1958,6 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\
 
 Value Name: RequireSecuritySignature
 
-Value Type: REG_DWORD
-Value: 1</check-content></check></Rule></Group><Group id="V-63705"><title>WN10-CC-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78195r4_rule" severity="medium" weight="10.0"><version>WN10-CC-000240</version><title>InPrivate browsing in Microsoft Edge must be disabled.</title><description>&lt;VulnDiscussion&gt;The InPrivate browsing feature in Microsoft Edge prevents the storing of history, cookies, temporary Internet files, or other data.  Disabling this feature maintains this data for review as necessary.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83243r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; "Allow InPrivate browsing" to "Disabled".</fixtext><fix id="F-83243r1_fix" /><check system="C-79107r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.
-
-If the following registry value does not exist or is not configured as specified, this is a finding.
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main\
-
-Value Name: AllowInPrivate
-
-Type: REG_DWORD
-Value: 0x00000000 (0)</check-content></check></Rule></Group><Group id="V-63707"><title>WN10-SO-000105</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78197r1_rule" severity="medium" weight="10.0"><version>WN10-SO-000105</version><title>The Windows SMB client must be enabled to perform SMB packet signing when possible.</title><description>&lt;VulnDiscussion&gt;The server message block (SMB) protocol provides the basis for many network operations.   If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><ident system="http://iase.disa.mil/cci">CCI-002421</ident><fixtext fixref="F-69635r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled".</fixtext><fix id="F-69635r1_fix" /><check system="C-64455r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\
-
-Value Name: EnableSecuritySignature
-
 Value Type: REG_DWORD
 Value: 1</check-content></check></Rule></Group><Group id="V-63709"><title>WN10-CC-000245</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78199r4_rule" severity="medium" weight="10.0"><version>WN10-CC-000245</version><title>The password manager function in the Edge browser must be disabled.</title><description>&lt;VulnDiscussion&gt;Passwords save locally for re-use when browsing may be subject to compromise.  Disabling the Edge password manager will prevent this for the browser.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-83245r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; "Configure Password Manager" to "Disabled".</fixtext><fix id="F-83245r1_fix" /><check system="C-79113r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.
 
@@ -2087,15 +2026,7 @@ Registry Path:  \SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity\
 Value Name:  MinimumPINLength
 
 Type:  REG_DWORD
-Value:  6 (or greater)</check-content></check></Rule></Group><Group id="V-63723"><title>WN10-SO-000125</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78213r1_rule" severity="medium" weight="10.0"><version>WN10-SO-000125</version><title>The Windows SMB server must perform SMB packet signing when possible.</title><description>&lt;VulnDiscussion&gt;The server message block (SMB) protocol provides the basis for many network operations.   Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002418</ident><ident system="http://iase.disa.mil/cci">CCI-002421</ident><fixtext fixref="F-69651r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; "Microsoft network server: Digitally sign communications (if Client agrees)" to "Enabled".</fixtext><fix id="F-69651r1_fix" /><check system="C-64471r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\
-
-Value Name: EnableSecuritySignature
-
-Value Type: REG_DWORD
-Value: 1</check-content></check></Rule></Group><Group id="V-63729"><title>WN10-CC-000270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78219r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000270</version><title>Passwords must not be saved in the Remote Desktop Client.</title><description>&lt;VulnDiscussion&gt;Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system.  The system must be configured to prevent users from saving passwords in the Remote Desktop Client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002038</ident><fixtext fixref="F-69657r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Remote Desktop Services &gt;&gt; Remote Desktop Connection Client &gt;&gt; "Do not allow passwords to be saved" to "Enabled".</fixtext><fix id="F-69657r1_fix" /><check system="C-64479r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
+Value:  6 (or greater)</check-content></check></Rule></Group><Group id="V-63729"><title>WN10-CC-000270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78219r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000270</version><title>Passwords must not be saved in the Remote Desktop Client.</title><description>&lt;VulnDiscussion&gt;Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system.  The system must be configured to prevent users from saving passwords in the Remote Desktop Client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002038</ident><fixtext fixref="F-69657r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Remote Desktop Services &gt;&gt; Remote Desktop Connection Client &gt;&gt; "Do not allow passwords to be saved" to "Enabled".</fixtext><fix id="F-69657r1_fix" /><check system="C-64479r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
 
 Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\
@@ -2203,14 +2134,6 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\
 
 Value Name: RestrictNullSessAccess
 
-Value Type: REG_DWORD
-Value: 1</check-content></check></Rule></Group><Group id="V-63763"><title>WN10-SO-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78253r1_rule" severity="medium" weight="10.0"><version>WN10-SO-000175</version><title>Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity vs. authenticating anonymously.</title><description>&lt;VulnDiscussion&gt;Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously vs. using the computer identity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000778</ident><fixtext fixref="F-69691r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; "Network security: Allow Local System to use computer identity for NTLM" to "Enabled".</fixtext><fix id="F-69691r1_fix" /><check system="C-64513r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\
-
-Value Name: UseMachineId
-
 Value Type: REG_DWORD
 Value: 1</check-content></check></Rule></Group><Group id="V-63765"><title>WN10-SO-000180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78255r1_rule" severity="medium" weight="10.0"><version>WN10-SO-000180</version><title>NTLM must be prevented from falling back to a Null session.</title><description>&lt;VulnDiscussion&gt;NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-69693r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; "Network security: Allow LocalSystem NULL session fallback" to "Disabled".</fixtext><fix id="F-69693r1_fix" /><check system="C-64517r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:
 
@@ -2691,20 +2614,7 @@ Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windo
 
 If any groups or accounts other than the following are granted the "Force shutdown from a remote system" user right, this is a finding:
 
-Administrators</check-content></check></Rule></Group><Group id="V-63887"><title>WN10-UR-000105</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78377r1_rule" severity="medium" weight="10.0"><version>WN10-UR-000105</version><title>The Generate security audits user right must only be assigned to Local Service and Network Service.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
-
-The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002235</ident><fixtext fixref="F-69815r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; "Generate security audits" to only include the following groups or accounts:
-
-LOCAL SERVICE
-NETWORK SERVICE</fixtext><fix id="F-69815r1_fix" /><check system="C-64637r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the effective setting in Local Group Policy Editor.
-Run "gpedit.msc".
-
-Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
-
-If any groups or accounts other than the following are granted the "Generate security audits" user right, this is a finding:
-
-LOCAL SERVICE
-NETWORK SERVICE</check-content></check></Rule></Group><Group id="V-63889"><title>WN10-UR-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78379r1_rule" severity="medium" weight="10.0"><version>WN10-UR-000110</version><title>The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
+Administrators</check-content></check></Rule></Group><Group id="V-63889"><title>WN10-UR-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78379r1_rule" severity="medium" weight="10.0"><version>WN10-UR-000110</version><title>The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
 
 The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002235</ident><fixtext fixref="F-69817r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; "Impersonate a client after authentication" to only include the following groups or accounts:
 
@@ -2721,20 +2631,7 @@ If any groups or accounts other than the following are granted the "Impersonate
 Administrators
 LOCAL SERVICE
 NETWORK SERVICE
-SERVICE</check-content></check></Rule></Group><Group id="V-63891"><title>WN10-UR-000115</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78381r2_rule" severity="medium" weight="10.0"><version>WN10-UR-000115</version><title>The Increase scheduling priority user right on Windows 10 must only be assigned to Administrators and Window Manager\Window Manager Group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
-
-Accounts with the "Increase scheduling priority" user right can change a scheduling priority causing performance issues or a DoS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002235</ident><fixtext fixref="F-100995r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; "Increase scheduling priority" to only include the following groups or accounts:
-
-Administrators
-Window Manager\Window Manager Group</fixtext><fix id="F-100995r1_fix" /><check system="C-94085r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Verify the effective setting in Local Group Policy Editor.
-Run "gpedit.msc".
-
-Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
-
-If any groups or accounts other than the following are granted the "Increase scheduling priority" user right, this is a finding:
-
-Administrators
-Window Manager\Window Manager Group</check-content></check></Rule></Group><Group id="V-63917"><title>WN10-UR-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78407r1_rule" severity="medium" weight="10.0"><version>WN10-UR-000120</version><title>The Load and unload device drivers user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
+SERVICE</check-content></check></Rule></Group><Group id="V-63917"><title>WN10-UR-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-78407r1_rule" severity="medium" weight="10.0"><version>WN10-UR-000120</version><title>The Load and unload device drivers user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
 
 The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002235</ident><fixtext fixref="F-69845r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; "Load and unload device drivers" to only include the following groups or accounts:
 
@@ -3063,9 +2960,9 @@ Verify the Bluetooth radio is turned off unless approved by the organization. If
 
 Approval must be documented with the ISSO.</check-content></check></Rule></Group><Group id="V-72767"><title>WN10-00-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-87405r1_rule" severity="medium" weight="10.0"><version>WN10-00-000220</version><title>Bluetooth must be turned off when not in use.</title><description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-79177r1_fix">Turn off Bluetooth radios when not in use. Establish an organizational policy for the use of Bluetooth to include training of personnel.</fixtext><fix id="F-79177r1_fix" /><check system="C-72915r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA if the system does not have Bluetooth.
 
-Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.</check-content></check></Rule></Group><Group id="V-72769"><title>WN10-00-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-87407r1_rule" severity="medium" weight="10.0"><version>WN10-00-000230</version><title>The system must notify the user when a Bluetooth device attempts to connect.</title><description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-79179r1_fix">Configure Bluetooth to notify users if devices attempt to connect.
+Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.</check-content></check></Rule></Group><Group id="V-72769"><title>WN10-00-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-87407r2_rule" severity="medium" weight="10.0"><version>WN10-00-000230</version><title>The system must notify the user when a Bluetooth device attempts to connect.</title><description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-79179r1_fix">Configure Bluetooth to notify users if devices attempt to connect.
 View Bluetooth Settings.
-Ensure "Alert me when a new Bluetooth device wants to connect" is checked.</fixtext><fix id="F-79179r1_fix" /><check system="C-72917r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA if the system does not have Bluetooth.
+Ensure "Alert me when a new Bluetooth device wants to connect" is checked.</fixtext><fix id="F-79179r1_fix" /><check system="C-72917r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy.
 
 Search for "Bluetooth".
 View Bluetooth Settings.
@@ -3109,17 +3006,7 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010
 Value Name: EccCurves
 
 Value Type: REG_MULTI_SZ
-Value: NistP384 NistP256</check-content></check></Rule></Group><Group id="V-74415"><title>WN10-CC-000228</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89089r4_rule" severity="medium" weight="10.0"><version>WN10-CC-000228</version><title>Windows 10 must be configured to prevent Microsoft Edge browser data from being cleared on exit.</title><description>&lt;VulnDiscussion&gt;Clearing browser data on exit automatically deletes specified items when the last browser window closes.  This data could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures.  Disabling this function will prevent the data from automatically being deleted when the browser closes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-80957r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; "Allow clearing browsing data on exit" to "Disabled".</fixtext><fix id="F-80957r1_fix" /><check system="C-94091r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.
-
-If the following registry value does not exist or is not configured as specified, this is a finding.
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Privacy\
-
-Value Name: ClearBrowsingHistoryOnExit
-
-Type: REG_DWORD
-Value: 0x00000000 (0)</check-content></check></Rule></Group><Group id="V-74417"><title>WN10-CC-000252</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89091r2_rule" severity="medium" weight="10.0"><version>WN10-CC-000252</version><title>Windows 10 must be configured to disable Windows Game Recording and Broadcasting.</title><description>&lt;VulnDiscussion&gt;Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-80959r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Game Recording and Broadcasting &gt;&gt; "Enables or disables Windows Game Recording and Broadcasting" to "Disabled".</fixtext><fix id="F-80959r1_fix" /><check system="C-91423r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA for Windows 10 LTSC\B versions 1507 and 1607.
+Value: NistP384 NistP256</check-content></check></Rule></Group><Group id="V-74417"><title>WN10-CC-000252</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89091r2_rule" severity="medium" weight="10.0"><version>WN10-CC-000252</version><title>Windows 10 must be configured to disable Windows Game Recording and Broadcasting.</title><description>&lt;VulnDiscussion&gt;Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-80959r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Game Recording and Broadcasting &gt;&gt; "Enables or disables Windows Game Recording and Broadcasting" to "Disabled".</fixtext><fix id="F-80959r1_fix" /><check system="C-91423r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA for Windows 10 LTSC\B versions 1507 and 1607.
 
 If the following registry value does not exist or is not configured as specified, this is a finding.
 
@@ -3371,26 +3258,26 @@ If the status of "Heap: TerminateOnError" is "OFF", this is a finding.
 
 Values that would not be a finding include:
 ON
-NOTSET (Default configuration)</check-content></check></Rule></Group><Group id="V-77189"><title>WN10-EP-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91885r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000070</version><title>Exploit Protection mitigations in Windows 10 must be configured for Acrobat.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84325r4_fix">Ensure the following mitigations are turned "ON" for Acrobat.exe:
+NOTSET (Default configuration)</check-content></check></Rule></Group><Group id="V-77189"><title>WN10-EP-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91885r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000070</version><title>Exploit Protection mitigations in Windows 10 must be configured for Acrobat.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84325r6_fix">Ensure the following mitigations are configured as shown for Acrobat.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-BottomUp: ON
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84325r4_fix" /><check system="C-94095r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84325r6_fix" /><check system="C-94095r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3399,43 +3286,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name Acrobat.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-BottomUp: ON
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77191"><title>WN10-EP-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91887r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000080</version><title>Exploit Protection mitigations in Windows 10 must be configured for AcroRd32.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84329r4_fix">Ensure the following mitigations are turned "ON" for AcroRd32.exe:
+The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77191"><title>WN10-EP-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91887r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000080</version><title>Exploit Protection mitigations in Windows 10 must be configured for AcroRd32.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84329r5_fix">Ensure the following mitigations are configured as shown for AcroRd32.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-BottomUp: ON
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot= False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84329r4_fix" /><check system="C-94097r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84329r5_fix" /><check system="C-94097r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3444,31 +3331,31 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name AcroRd32.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-BottomUp: ON
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot= False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77195"><title>WN10-EP-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91891r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000090</version><title>Exploit Protection mitigations in Windows 10 must be configured for chrome.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84333r4_fix">Ensure the following mitigations are turned "ON" for chrome.exe:
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77195"><title>WN10-EP-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91891r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000090</version><title>Exploit Protection mitigations in Windows 10 must be configured for chrome.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84333r5_fix">Ensure the following mitigations are configured as shown forchrome.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84333r4_fix" /><check system="C-94099r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84333r5_fix" /><check system="C-94099r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3477,30 +3364,31 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name chrome.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77201"><title>WN10-EP-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91897r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000100</version><title>Exploit Protection mitigations in Windows 10 must be configured for EXCEL.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84337r4_fix">Ensure the following mitigations are turned "ON" for EXCEL.EXE:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77201"><title>WN10-EP-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91897r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000100</version><title>Exploit Protection mitigations in Windows 10 must be configured for EXCEL.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84337r5_fix">Ensure the following mitigations are configured as shown for EXCEL.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84337r4_fix" /><check system="C-94101r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84337r5_fix" /><check system="C-94101r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3509,34 +3397,35 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name EXCEL.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77205"><title>WN10-EP-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91901r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000110</version><title>Exploit Protection mitigations in Windows 10 must be configured for firefox.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-86915r1_fix">Ensure the following mitigations are turned "ON" for firefox.exe:
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77205"><title>WN10-EP-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91901r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000110</version><title>Exploit Protection mitigations in Windows 10 must be configured for firefox.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-86915r2_fix">Ensure the following mitigations are configured as shown  firefox.exe:
 
 DEP:
-Enable: ON
+Override DEP: False
 
 ASLR:
 BottomUp: ON
-ForceRelocateImages: ON
+ForceRelocateImages: True
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.</fixtext><fix id="F-86915r1_fix" /><check system="C-79777r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.</fixtext><fix id="F-86915r2_fix" /><check system="C-79777r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3544,38 +3433,36 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 
 Enter "Get-ProcessMitigation -Name firefox.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+Override DEP: False
 
 ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+ForceRelocateImages: True
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77209"><title>WN10-EP-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91905r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000120</version><title>Exploit Protection mitigations in Windows 10 must be configured for FLTLDR.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84341r4_fix">Ensure the following mitigations are turned "ON" for FLTLDR.EXE:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77209"><title>WN10-EP-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91905r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000120</version><title>Exploit Protection mitigations in Windows 10 must be configured for FLTLDR.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84341r5_fix">Ensure the following mitigations are configured as shown for FLTLDR.EXE:
 
 DEP:
-Enable: ON
+Override DEP: False
 
 ImageLoad:
-BlockRemoteImageLoads: ON
+ImageLoad OverrideBlockRemoteImages: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
 Child Process:
-DisallowChildProcessCreation: ON
+OverrideChildProcess: False
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84341r4_fix" /><check system="C-94103r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84341r5_fix" /><check system="C-94103r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3584,50 +3471,50 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name FLTLDR.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+Override DEP: False
 
 ImageLoad:
-BlockRemoteImageLoads: ON
+ImageLoad OverrideBlockRemoteImages: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
 Child Process:
-DisallowChildProcessCreation: ON
+OverrideChildProcess: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77213"><title>WN10-EP-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91909r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000130</version><title>Exploit Protection mitigations in Windows 10 must be configured for GROOVE.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84343r4_fix">Ensure the following mitigations are turned "ON" for GROOVE.EXE:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77213"><title>WN10-EP-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91909r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000130</version><title>Exploit Protection mitigations in Windows 10 must be configured for GROOVE.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84343r5_fix">Ensure the following mitigations are configured as shown GROOVE.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-ForceRelocateImages: ON
+OverrideBlockRemoteImages: False
 
 ImageLoad:
-BlockRemoteImageLoads: ON
+ForceRelocateImages: True
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
 Child Process:
-DisallowChildProcessCreation: ON
+OverrideChildProcess: False
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84343r4_fix" /><check system="C-94105r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84343r5_fix" /><check system="C-94105r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3636,48 +3523,48 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name GROOVE.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-ForceRelocateImages: ON
+ForceRelocateImages: True
 
 ImageLoad:
-BlockRemoteImageLoads: ON
+OverrideBlockRemoteImages: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
 Child Process:
-DisallowChildProcessCreation: ON
+OverrideChildProcess: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77217"><title>WN10-EP-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91913r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000140</version><title>Exploit Protection mitigations in Windows 10 must be configured for iexplore.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84347r4_fix">Ensure the following mitigations are turned "ON" for iexplore.exe:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here.  If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77217"><title>WN10-EP-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91913r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000140</version><title>Exploit Protection mitigations in Windows 10 must be configured for iexplore.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84347r5_fix">Ensure the following mitigations are configured as shown for iexplore.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-BottomUp: ON
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84347r4_fix" /><check system="C-94107r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84347r5_fix" /><check system="C-94107r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3686,42 +3573,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name iexplore.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
-BottomUp: ON
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77221"><title>WN10-EP-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91917r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000150</version><title>Exploit Protection mitigations in Windows 10 must be configured for INFOPATH.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84349r4_fix">Ensure the following mitigations are turned "ON" for INFOPATH.EXE:
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77221"><title>WN10-EP-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91917r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000150</version><title>Exploit Protection mitigations in Windows 10 must be configured for INFOPATH.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84349r5_fix">Ensure the following mitigations are configured as shown for INFOPATH.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84349r4_fix" /><check system="C-94109r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84349r5_fix" /><check system="C-94109r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3730,38 +3618,40 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name INFOPATH.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77223"><title>WN10-EP-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91919r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000160</version><title>Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84353r3_fix">Ensure the following mitigations are turned "ON" for java.exe, javaw.exe, and javaws.exe:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77223"><title>WN10-EP-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91919r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000160</version><title>Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84353r4_fix">Ensure the following mitigations are configured for java.exe, javaw.exe, and javaws.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84353r3_fix" /><check system="C-94111r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84353r4_fix" /><check system="C-94111r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3771,38 +3661,40 @@ Enter "Get-ProcessMitigation -Name [application name]" with each of the followin
 java.exe, javaw.exe, and javaws.exe
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON" for each, this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77227"><title>WN10-EP-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91923r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000170</version><title>Exploit Protection mitigations in Windows 10 must be configured for lync.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84357r4_fix">Ensure the following mitigations are turned "ON" for lync.exe:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77227"><title>WN10-EP-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91923r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000170</version><title>Exploit Protection mitigations in Windows 10 must be configured for lync.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84357r6_fix">Ensure the following mitigations are configured as shown for lync.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84357r4_fix" /><check system="C-94113r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84357r6_fix" /><check system="C-94113r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3811,41 +3703,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name lync.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77231"><title>WN10-EP-000180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91927r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000180</version><title>Exploit Protection mitigations in Windows 10 must be configured for MSACCESS.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84359r4_fix">Ensure the following mitigations are turned "ON" for MSACCESS.EXE:
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77231"><title>WN10-EP-000180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91927r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000180</version><title>Exploit Protection mitigations in Windows 10 must be configured for MSACCESS.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84359r5_fix">Ensure the following mitigations are configured as shown for MSACCESS.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84359r4_fix" /><check system="C-94115r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84359r5_fix" /><check system="C-94115r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3854,41 +3748,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name MSACCESS.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77233"><title>WN10-EP-000190</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91929r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000190</version><title>Exploit Protection mitigations in Windows 10 must be configured for MSPUB.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84361r4_fix">Ensure the following mitigations are turned "ON" for MSPUB.EXE:
+
+The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77233"><title>WN10-EP-000190</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91929r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000190</version><title>Exploit Protection mitigations in Windows 10 must be configured for MSPUB.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84361r5_fix">Ensure the following mitigations are configured as shown for MSPUB.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84361r4_fix" /><check system="C-94117r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84361r5_fix" /><check system="C-94117r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3897,44 +3793,46 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name MSPUB.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77235"><title>WN10-EP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91931r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000210</version><title>Exploit Protection mitigations in Windows 10 must be configured for OneDrive.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84321r5_fix">Ensure the following mitigations are turned "ON" for OneDrive.exe:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77235"><title>WN10-EP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91931r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000210</version><title>Exploit Protection mitigations in Windows 10 must be configured for OneDrive.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84321r6_fix">Ensure the following mitigations are configured for OneDrive.exe:
 
 DEP:
-Enable: ON
+Override DEP: False
 
 ASLR:
-ForceRelocateImages: ON
+OverrideRelocateImages: False
 
 ImageLoad:
-BlockRemoteImageLoads: ON
+OverrideBlockRemoteImages: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84321r5_fix" /><check system="C-94119r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84321r6_fix" /><check system="C-94119r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3943,41 +3841,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name OneDrive.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+Override DEP: False
 
 ASLR:
-ForceRelocateImages: ON
+OverrideRelocateImages: False
 
 ImageLoad:
-BlockRemoteImageLoads: ON
+OverrideBlockRemoteImages: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77239"><title>WN10-EP-000200</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91935r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000200</version><title>Exploit Protection mitigations in Windows 10 must be configured for OIS.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84315r4_fix">Ensure the following mitigations are turned "ON" for OIS.EXE:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77239"><title>WN10-EP-000200</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91935r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000200</version><title>Exploit Protection mitigations in Windows 10 must be configured for OIS.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84315r5_fix">Ensure the following mitigations are configured as shown for OIS.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84315r4_fix" /><check system="C-94121r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84315r5_fix" /><check system="C-94121r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -3986,38 +3886,40 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name OIS.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77243"><title>WN10-EP-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91939r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000220</version><title>Exploit Protection mitigations in Windows 10 must be configured for OUTLOOK.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84363r4_fix">Ensure the following mitigations are turned "ON" for OUTLOOK.EXE:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77243"><title>WN10-EP-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91939r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000220</version><title>Exploit Protection mitigations in Windows 10 must be configured for OUTLOOK.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84363r5_fix">Ensure the following mitigations are configured as shown for OUTLOOK.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84363r4_fix" /><check system="C-94123r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84363r5_fix" /><check system="C-94123r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4026,23 +3928,24 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name OUTLOOK.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77245"><title>WN10-EP-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91941r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000230</version><title>Exploit Protection mitigations in Windows 10 must be configured for plugin-container.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84365r4_fix">Ensure the following mitigations are turned "ON" for plugin-container.exe:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77245"><title>WN10-EP-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91941r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000230</version><title>Exploit Protection mitigations in Windows 10 must be configured for plugin-container.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84365r4_fix">Ensure the following mitigations are turned "ON" for plugin-container.exe:
 
 DEP:
 Enable: ON
@@ -4079,25 +3982,26 @@ EnableRopStackPivot: ON
 EnableRopCallerCheck: ON
 EnableRopSimExec: ON
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77247"><title>WN10-EP-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91943r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000240</version><title>Exploit Protection mitigations in Windows 10 must be configured for POWERPNT.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84503r5_fix">Ensure the following mitigations are turned "ON" for POWERPNT.EXE:
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77247"><title>WN10-EP-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91943r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000240</version><title>Exploit Protection mitigations in Windows 10 must be configured for POWERPNT.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84503r6_fix">Ensure the following mitigations are configured as shown for POWERPNT.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84503r5_fix" /><check system="C-94127r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84503r6_fix" /><check system="C-94127r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4106,41 +4010,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name POWERPNT.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77249"><title>WN10-EP-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91945r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000250</version><title>Exploit Protection mitigations in Windows 10 must be configured for PPTVIEW.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84505r4_fix">Ensure the following mitigations are turned "ON" for PPTVIEW.EXE:
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77249"><title>WN10-EP-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91945r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000250</version><title>Exploit Protection mitigations in Windows 10 must be configured for PPTVIEW.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84505r5_fix">Ensure the following mitigations are configured as shown for PPTVIEW.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84505r4_fix" /><check system="C-94129r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84505r5_fix" /><check system="C-94129r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4149,41 +4055,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name PPTVIEW.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77255"><title>WN10-EP-000260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91951r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000260</version><title>Exploit Protection mitigations in Windows 10 must be configured for VISIO.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84507r4_fix">Ensure the following mitigations are turned "ON" for VISIO.EXE:
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77255"><title>WN10-EP-000260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91951r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000260</version><title>Exploit Protection mitigations in Windows 10 must be configured for VISIO.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84507r6_fix">Ensure the following mitigations are configured as shown for VISIO.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84507r4_fix" /><check system="C-94131r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84507r6_fix" /><check system="C-94131r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4192,41 +4100,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name VISIO.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77259"><title>WN10-EP-000270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91955r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000270</version><title>Exploit Protection mitigations in Windows 10 must be configured for VPREVIEW.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84509r4_fix">Ensure the following mitigations are turned "ON" for VPREVIEW.EXE:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77259"><title>WN10-EP-000270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91955r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000270</version><title>Exploit Protection mitigations in Windows 10 must be configured for VPREVIEW.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84509r5_fix">Ensure the following mitigations are configured as shown for VPREVIEW.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84509r4_fix" /><check system="C-94133r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84509r5_fix" /><check system="C-94133r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4235,41 +4145,43 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name VPREVIEW.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77263"><title>WN10-EP-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91959r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000280</version><title>Exploit Protection mitigations in Windows 10 must be configured for WINWORD.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84511r4_fix">Ensure the following mitigations are turned "ON" for WINWORD.EXE:
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77263"><title>WN10-EP-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91959r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000280</version><title>Exploit Protection mitigations in Windows 10 must be configured for WINWORD.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84511r5_fix">Ensure the following mitigations are configured as shown for WINWORD.EXE:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84511r4_fix" /><check system="C-94135r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84511r5_fix" /><check system="C-94135r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4278,35 +4190,40 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name WINWORD.EXE".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 ASLR:
 ForceRelocateImages: ON
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77267"><title>WN10-EP-000290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91963r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000290</version><title>Exploit Protection mitigations in Windows 10 must be configured for wmplayer.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84513r4_fix">Ensure the following mitigations are turned "ON" for wmplayer.exe:
+
+The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77267"><title>WN10-EP-000290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91963r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000290</version><title>Exploit Protection mitigations in Windows 10 must be configured for wmplayer.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84513r5_fix">Ensure the following mitigations are configured as shown for wmplayer.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84513r4_fix" /><check system="C-94137r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84513r5_fix" /><check system="C-94137r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4315,32 +4232,36 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name wmplayer.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77269"><title>WN10-EP-000300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91965r3_rule" severity="medium" weight="10.0"><version>WN10-EP-000300</version><title>Exploit Protection mitigations in Windows 10 must be configured for wordpad.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84515r4_fix">Ensure the following mitigations are turned "ON" for wordpad.exe:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-77269"><title>WN10-EP-000300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-91965r4_rule" severity="medium" weight="10.0"><version>WN10-EP-000300</version><title>Exploit Protection mitigations in Windows 10 must be configured for wordpad.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-84515r5_fix">Ensure the following mitigations are configured as shown for wordpad.exe:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
 Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder.
 
-The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84515r4_fix" /><check system="C-94139r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
+The XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:".  It is recommended the file be in a read-only network location.</fixtext><fix id="F-84515r5_fix" /><check system="C-94139r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
@@ -4349,20 +4270,21 @@ Run "Windows PowerShell" with elevated privileges (run as administrator).
 Enter "Get-ProcessMitigation -Name wordpad.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
 DEP:
-Enable: ON
+OverrideDEP: False
 
 Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-78129"><title>WN10-00-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92835r1_rule" severity="high" weight="10.0"><version>WN10-00-000240</version><title>Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.</title><description>&lt;VulnDiscussion&gt;Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id="V-78129"><title>WN10-00-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92835r1_rule" severity="high" weight="10.0"><version>WN10-00-000240</version><title>Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.</title><description>&lt;VulnDiscussion&gt;Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.
 
 Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.
 
@@ -4412,13 +4334,13 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\
 Value Name: LimitEnhancedDiagnosticDataWindowsAnalytics
 
 Type: REG_DWORD
-Value: 0x00000001 (1)</check-content></check></Rule></Group><Group id="V-88203"><title>WN10-CC-000340</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-98853r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000340</version><title>OneDrive must only allow synchronizing of accounts for DoD organization instances.</title><description>&lt;VulnDiscussion&gt;OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-94945r3_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; OneDrive &gt;&gt; "Allow syncing OneDrive accounts for only specific organizations", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.
+Value: 0x00000001 (1)</check-content></check></Rule></Group><Group id="V-88203"><title>WN10-CC-000340</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-98853r3_rule" severity="medium" weight="10.0"><version>WN10-CC-000340</version><title>OneDrive must only allow synchronizing of accounts for DoD organization instances.</title><description>&lt;VulnDiscussion&gt;OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-94945r4_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; OneDrive &gt;&gt; "Allow syncing OneDrive accounts for only specific organizations", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.
 
 If the organization does not have an instance of OneDrive, configure the Tenant GUID with "1111-2222-3333-4444".
 
 Group policy files for OneDrive are located on a system with OneDrive in "%localappdata%\Microsoft\OneDrive\BuildNumber\adm\".
 
-Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.</fixtext><fix id="F-94945r3_fix" /><check system="C-87895r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.
+Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.</fixtext><fix id="F-94945r4_fix" /><check system="C-87895r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.
 
 If the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances.
 
@@ -4478,8 +4400,184 @@ Value: 0x00000001 (1)
 
 BitLocker network unlock may be used in conjunction with a BitLocker PIN. See the article below regarding information about network unlock.
 
-https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock</check-content></check></Rule></Group><Group id="V-94861"><title>WN10-00-000032</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104691r1_rule" severity="medium" weight="10.0"><version>WN10-00-000032</version><title>Windows 10 systems must use a BitLocker PIN with a minimum length of 6 digits for pre-boot authentication.</title><description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><ident system="http://iase.disa.mil/cci">CCI-002475</ident><ident system="http://iase.disa.mil/cci">CCI-002476</ident><fixtext fixref="F-100985r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; BitLocker Drive Encryption &gt;&gt; Operating System Drives "Configure minimum PIN length for startup" to "Enabled" with "Minimum characters:" set to "6" or greater.</fixtext><fix id="F-100985r1_fix" /><check system="C-94057r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.
+https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock</check-content></check></Rule></Group><Group id="V-94861"><title>WN10-00-000032</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-104691r2_rule" severity="medium" weight="10.0"><version>WN10-00-000032</version><title>Windows 10 systems must use a BitLocker PIN with a minimum length of 6 digits for pre-boot authentication.</title><description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001199</ident><ident system="http://iase.disa.mil/cci">CCI-002475</ident><ident system="http://iase.disa.mil/cci">CCI-002476</ident><fixtext fixref="F-100985r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; BitLocker Drive Encryption &gt;&gt; Operating System Drives "Configure minimum PIN length for startup" to "Enabled" with "Minimum characters:" set to "6" or greater.</fixtext><fix id="F-100985r1_fix" /><check system="C-94057r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\FVE\
 
 Value Name: MinimumPIN
 Type: REG_DWORD
-Value: 0x00000006 (6) or greater</check-content></check></Rule></Group></Benchmark>
+Value: 0x00000006 (6) or greater</check-content></check></Rule></Group><Group id="V-99541"><title>WN10-AU-000565</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108645r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000565</version><title>Windows 10 must be configured to audit other Logon/Logoff Events Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-105225r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; "Audit Other Logon/Logoff Events" with "Failure" selected.</fixtext><fix id="F-105225r1_fix" /><check system="C-98389r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Logon/Logoff  &gt;&gt; Other Logon/Logoff Events - Failure
+</check-content></check></Rule></Group><Group id="V-99543"><title>WN10-AU-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108647r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000560</version><title>Windows 10 must be configured to audit other Logon/Logoff Events Successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-105227r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; "Audit Other Logon/Logoff Events" with "Success" selected.</fixtext><fix id="F-105227r1_fix" /><check system="C-98393r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Logon/Logoff  &gt;&gt; Other Logon/Logoff Events - Success
+</check-content></check></Rule></Group><Group id="V-99545"><title>WN10-AU-000570</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108649r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000570</version><title>Windows 10 must be configured to audit Detailed File Share Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Detailed File Share allows you to audit attempts to access files and folders on a shared folder.
+The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-105229r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; “Detailed File Share" with "Failure" selected.</fixtext><fix id="F-105229r1_fix" /><check system="C-98395r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Object Access  &gt;&gt; Detailed File Share - Failure
+</check-content></check></Rule></Group><Group id="V-99547"><title>WN10-AU-000575</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108651r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000575</version><title>Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe).
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-105231r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; “Audit MPSSVC Rule-Level Policy Change" with "Success" selected.</fixtext><fix id="F-105231r1_fix" /><check system="C-98397r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; MPSSVC Rule-Level Policy Change - Success
+</check-content></check></Rule></Group><Group id="V-99549"><title>WN10-AU-000580</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108653r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000580</version><title>Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe).
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-105233r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; “Audit MPSSVC Rule-Level Policy Change" with "Failure" selected.</fixtext><fix id="F-105233r1_fix" /><check system="C-98399r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; MPSSVC Rule-Level Policy Change - Failure
+</check-content></check></Rule></Group><Group id="V-99551"><title>WN10-AU-000550</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108655r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000550</version><title>Windows 10 must be configured to audit Other Policy Change Events Successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-105235r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change&gt;&gt; "Audit Other Policy Change Events" with "Success" selected.</fixtext><fix id="F-105235r1_fix" /><check system="C-98401r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; Other Policy Change Events - Success
+</check-content></check></Rule></Group><Group id="V-99553"><title>WN10-AU-000555</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108657r1_rule" severity="medium" weight="10.0"><version>WN10-AU-000555</version><title>Windows 10 must be configured to audit Other Policy Change Events Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000130</ident><fixtext fixref="F-105237r1_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change&gt;&gt; "Audit Other Policy Change Events" with "Failure" selected.</fixtext><fix id="F-105237r1_fix" /><check system="C-98403r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; Other Policy Change Events - Failure
+</check-content></check></Rule></Group><Group id="V-99555"><title>WN10-SO-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108659r2_rule" severity="medium" weight="10.0"><version>WN10-SO-000280</version><title>Passwords for enabled local Administrator accounts must be changed at least every 60 days.</title><description>&lt;VulnDiscussion&gt;The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure.
+
+Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000199</ident><fixtext fixref="F-105239r2_fix">Change the enabled local Administrator account password at least every "60" days.
+
+Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to meet this requirement.
+</fixtext><fix id="F-105239r2_fix" /><check system="C-98405r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>Review the password last set date for the enabled local Administrator account.
+
+On the local domain joined workstation:
+
+Open "PowerShell".
+
+Enter "Get-LocalUser –Name * | Select-Object *”
+
+If the "PasswordLastSet" date is greater than "60" days old for the local Administrator account for administering the computer/domain, this is a finding.
+</check-content></check></Rule></Group><Group id="V-99557"><title>WN10-EP-000310</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108661r1_rule" severity="medium" weight="10.0"><version>WN10-EP-000310</version><title>Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled.</title><description>&lt;VulnDiscussion&gt;Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001090</ident><fixtext fixref="F-105241r4_fix">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Kernel DMA Protection &gt;&gt; "Enumeration policy for external devices incompatible with Kernel DMA Protection" to "Enabled" with "Enumeration Policy" set to "Block All".</fixtext><fix id="F-105241r4_fix" /><check system="C-98407r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>This is NA prior to v1803 of Windows 10.
+
+If the following registry value does not exist or is not configured as specified, this is a finding.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \Software\Policies\Microsoft\Windows\Kernel DMA Protection
+
+Value Name: DeviceEnumerationPolicy
+Value Type: REG_DWORD
+Value: 0</check-content></check></Rule></Group><Group id="V-99559"><title>WN10-CC-000370</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108663r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000370</version><title>The convenience PIN for Windows 10 must be disabled.  </title><description>&lt;VulnDiscussion&gt;This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105243r1_fix">Disable the convenience PIN sign-in.
+
+If this needs to be corrected configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Logon &gt;&gt; Set "Turn on convenience PIN sign-in" to "Disabled”.
+</fixtext><fix id="F-105243r1_fix" /><check system="C-98409r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \Software\Policies\Microsoft\Windows\System
+
+Value Name: AllowDomainPINLogon
+Value Type: REG_DWORD
+Value data: 0</check-content></check></Rule></Group><Group id="V-99561"><title>WN10-CC-000385</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108665r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000385</version><title>Windows Ink Workspace configured but disallow access above the lock.  </title><description>&lt;VulnDiscussion&gt;Securing Windows Ink which contains application and features oriented towards pen computing. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105245r1_fix">Disable the convenience PIN sign-in.
+
+If this needs to be corrected configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Ink Workspace   &gt;&gt; Set " Allow Windows Ink Workspace" to "Enabled” Set Options ‘On, but disallow access above lock”.
+</fixtext><fix id="F-105245r1_fix" /><check system="C-98411r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \Software\Policies\Microsoft\WindowsInkWorkspace
+
+Value Name: AllowWindowsInkWorkspace
+Value Type: REG_DWORD
+Value data: 1
+
+</check-content></check></Rule></Group><Group id="V-99563"><title>WN10-CC-000390</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-108667r1_rule" severity="low" weight="10.0"><version>WN10-CC-000390</version><title>Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications. </title><description>&lt;VulnDiscussion&gt;Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105247r1_fix">Configure the policy value for User Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Cloud Content &gt;&gt; "Do not suggest third-party content in Windows spotlight" to "Enabled</fixtext><fix id="F-105247r1_fix" /><check system="C-98413r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.
+
+If the following registry value does not exist or is not configured as specified, this is a finding:
+
+Registry Hive: HKEY_CURRENT_USER
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CloudContent\
+
+Value Name: DisableThirdPartySuggestions
+
+Type: REG_DWORD
+Value: 0x00000001 (1)
+
+</check-content></check></Rule></Group><Group id="V-100093"><title>SRG-OS-000095-GPOS-00049</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-109197r1_rule" severity="medium" weight="10.0"><version>WN10-CC-000007</version><title>Windows 10 must cover or disable the built-in or attached camera when not in use.</title><description>&lt;VulnDiscussion&gt;It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.
+
+Failing to disconnect from collaborative computing devices (i.e. cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures.
+
+Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000381</ident><fixtext fixref="F-105777r3_fix">If the camera is not disconnected or covered, the following registry entry is required.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam
+
+Value Name: Deny
+</fixtext><fix id="F-105777r3_fix" /><check system="C-98943r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_10_STIG.xml" /><check-content>If the device or operating system does not have a camera installed, this requirement is not applicable.
+
+This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.
+
+This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.
+
+For an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding.
+
+For a built-in camera, the camera must be protected by a camera cover (e.g. laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or if the built-in
+camera is not disabled in the bios, this is a finding.
+
+If the camera is not disconnected or covered, the following registry entry is required:
+
+Registry Hive: HKEY_LOCAL_MACHINE
+RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam
+
+Value Name: Deny
+
+If "Value Name" is set to a value other than "Deny" and the collaborative computing device has not been authorized for use, this is a finding.
+</check-content></check></Rule></Group></Benchmark>
diff --git a/StigData/Archive/Windows.DNS/U_MS_Windows_2012_Server_DNS_STIG_V1R12_Manual-xccdf.log b/source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_STIG_V1R14_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.DNS/U_MS_Windows_2012_Server_DNS_STIG_V1R12_Manual-xccdf.log
rename to source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_STIG_V1R14_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.DNS/U_MS_Windows_2012_Server_DNS_STIG_V1R12_Manual-xccdf.xml b/source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_STIG_V1R14_Manual-xccdf.xml
similarity index 83%
rename from StigData/Archive/Windows.DNS/U_MS_Windows_2012_Server_DNS_STIG_V1R12_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_STIG_V1R14_Manual-xccdf.xml
index 9cb98587e..01a3e75c0 100644
--- a/StigData/Archive/Windows.DNS/U_MS_Windows_2012_Server_DNS_STIG_V1R12_Manual-xccdf.xml
+++ b/source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_STIG_V1R14_Manual-xccdf.xml
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Microsoft_Windows_2012_Server_Domain_Name_System_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-06-28">accepted</status><title>Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide</title><description>The Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 12 Benchmark Date: 26 Jul 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Group id="V-58237"><title>SRG-APP-000001-DNS-000115</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-72667r3_rule" severity="medium" weight="10.0"><version>WDNS-AC-000001</version><title>The Windows 2012 DNS Server must restrict incoming dynamic update requests to known clients.</title><description>&lt;VulnDiscussion&gt;Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) on any system.
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Microsoft_Windows_2012_Server_Domain_Name_System_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-23">accepted</status><title>Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide</title><description>The Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="https://public.cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 14 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-58237" selected="true" /><select idref="V-58543" selected="true" /><select idref="V-58547" selected="true" /><select idref="V-58549" selected="true" /><select idref="V-58551" selected="true" /><select idref="V-58553" selected="true" /><select idref="V-58555" selected="true" /><select idref="V-58557" selected="true" /><select idref="V-58561" selected="true" /><select idref="V-58563" selected="true" /><select idref="V-58565" selected="true" /><select idref="V-58567" selected="true" /><select idref="V-58569" selected="true" /><select idref="V-58571" selected="true" /><select idref="V-58573" selected="true" /><select idref="V-58575" selected="true" /><select idref="V-58577" selected="true" /><select idref="V-58579" selected="true" /><select idref="V-58581" selected="true" /><select idref="V-58583" selected="true" /><select idref="V-58585" selected="true" /><select idref="V-58587" selected="true" /><select idref="V-58589" selected="true" /><select idref="V-58591" selected="true" /><select idref="V-58593" selected="true" /><select idref="V-58595" selected="true" /><select idref="V-58597" selected="true" /><select idref="V-58599" selected="true" /><select idref="V-58601" selected="true" /><select idref="V-58603" selected="true" /><select idref="V-58605" selected="true" /><select idref="V-58607" selected="true" /><select idref="V-58609" selected="true" /><select idref="V-58611" selected="true" /><select idref="V-58613" selected="true" /><select idref="V-58615" selected="true" /><select idref="V-58617" selected="true" /><select idref="V-58619" selected="true" /><select idref="V-58621" selected="true" /><select idref="V-58623" selected="true" /><select idref="V-58625" selected="true" /><select idref="V-58627" selected="true" /><select idref="V-58629" selected="true" /><select idref="V-58631" selected="true" /><select idref="V-58633" selected="true" /><select idref="V-58635" selected="true" /><select idref="V-58637" selected="true" /><select idref="V-58639" selected="true" /><select idref="V-58641" selected="true" /><select idref="V-58643" selected="true" /><select idref="V-58645" selected="true" /><select idref="V-58647" selected="true" /><select idref="V-58649" selected="true" /><select idref="V-58651" selected="true" /><select idref="V-58653" selected="true" /><select idref="V-58655" selected="true" /><select idref="V-58657" selected="true" /><select idref="V-58659" selected="true" /><select idref="V-58661" selected="true" /><select idref="V-58663" selected="true" /><select idref="V-58665" selected="true" /><select idref="V-58667" selected="true" /><select idref="V-58669" selected="true" /><select idref="V-58671" selected="true" /><select idref="V-58673" selected="true" /><select idref="V-58675" selected="true" /><select idref="V-58677" selected="true" /><select idref="V-58679" selected="true" /><select idref="V-58681" selected="true" /><select idref="V-58683" selected="true" /><select idref="V-58685" selected="true" /><select idref="V-58687" selected="true" /><select idref="V-58689" selected="true" /><select idref="V-58691" selected="true" /><select idref="V-58693" selected="true" /><select idref="V-58695" selected="true" /><select idref="V-58697" selected="true" /><select idref="V-58699" selected="true" /><select idref="V-58701" selected="true" /><select idref="V-58703" selected="true" /><select idref="V-58705" selected="true" /><select idref="V-58707" selected="true" /><select idref="V-58709" selected="true" /><select idref="V-58711" selected="true" /><select idref="V-58713" selected="true" /><select idref="V-58715" selected="true" /><select idref="V-58717" selected="true" /><select idref="V-58719" selected="true" /><select idref="V-58737" selected="true" /><select idref="V-58739" selected="true" /></Profile><Group id="V-58237"><title>SRG-APP-000001-DNS-000115</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-72667r3_rule" severity="medium" weight="10.0"><version>WDNS-AC-000001</version><title>The Windows 2012 DNS Server must restrict incoming dynamic update requests to known clients.</title><description>&lt;VulnDiscussion&gt;Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) on any system.
 
 A DNS server's function requires it to be able to handle multiple sessions at a time so limiting concurrent sessions could potentially cause an impact to availability.
 Primary name servers need to be configured to limit the actual hosts from which they will accept dynamic updates and from which they will accept zone transfer requests, and all name servers should be configured to limit the hosts from/to which they receive/send zone transfers. Restricting sessions to known hosts will mitigate the DoS vulnerability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000054</ident><fixtext fixref="F-63465r3_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
@@ -98,20 +98,22 @@ Click on the “Event Logging” tab. By default, all events are logged.
 
 Verify "Errors and warnings" or "All events" is selected.
 
-If any option other than "Errors and warnings" or "All events" is selected, this is a finding.</check-content></check></Rule></Group><Group id="V-58551"><title>SRG-APP-000089-DNS-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-72981r5_rule" severity="medium" weight="10.0"><version>WDNS-AU-000006</version><title>The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions.</title><description>&lt;VulnDiscussion&gt;DNS server performance can be affected when additional logging is enabled, however the enhanced DNS logging and diagnostics feature in Windows Server 2012 R2 is designed to have a very low impact on performance. Enhanced DNS logging and diagnostics in Windows Server 2012 R2 and later includes DNS Audit events and DNS Analytic events. DNS audit logs are enabled by default, and do not significantly affect DNS server performance. DNS analytical logs are not enabled by default and typically will only affect DNS server performance at very high DNS query rates.
+If any option other than "Errors and warnings" or "All events" is selected, this is a finding.</check-content></check></Rule></Group><Group id="V-58551"><title>SRG-APP-000089-DNS-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-72981r6_rule" severity="medium" weight="10.0"><version>WDNS-AU-000006</version><title>The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions.</title><description>&lt;VulnDiscussion&gt;DNS server performance can be affected when additional logging is enabled, however the enhanced DNS logging and diagnostics feature in Windows Server 2012 R2 is designed to have a very low impact on performance. Enhanced DNS logging and diagnostics in Windows Server 2012 R2 and later includes DNS Audit events and DNS Analytic events. DNS audit logs are enabled by default, and do not significantly affect DNS server performance. DNS analytical logs are not enabled by default and typically will only affect DNS server performance at very high DNS query rates.
 
 Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. The actual auditing is performed by the OS/NDM, but the configuration to trigger the auditing is controlled by the DNS server.
 
 In order to compile an accurate risk assessment, it is essential for security personnel to know what is being performed on the system, where an event occurred, when an event occurred, and by whom the event was triggered. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured DNS system. If auditing is not comprehensive, it will not be useful for intrusion monitoring, security investigations, and forensic analysis. It is important, therefore, to log all possible data related to events so that they can be correlated and analyzed to determine the risk.
 
-Data required to be captured include: whether an event was successful or failed, the event type or category, timestamps for when the event occurred, where the event originated, who/what initiated the event,  affect the event had on the DNS implementation and any processes associated with the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000169</ident><fixtext fixref="F-63935r3_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+Data required to be captured include: whether an event was successful or failed, the event type or category, timestamps for when the event occurred, where the event originated, who/what initiated the event,  affect the event had on the DNS implementation and any processes associated with the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000169</ident><fixtext fixref="F-63935r4_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Open an elevated Windows PowerShell prompt on the DNS server to which event logging needs to be enabled.
 
 Use the “Set-DnsServerDiagnostics” cmdlet to enable the required diagnostic events.
 
-Set-DnsServerDiagnostics $true &lt;enter&gt; for the required diagnostic events.
-</fixtext><fix id="F-63935r3_fix" /><check system="C-59423r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+Set-DnsServerDiagnostics -&lt;diagnostic event&gt; $true &lt;enter&gt; for the required diagnostic events.
+For example, to set EnableLoggingForLocalLookupEvent to true, enter the following at the command line:
+Set-DnsServerDiagnostics -EnableLoggingForLocalLookupEvent $true &lt;enter&gt;
+</fixtext><fix id="F-63935r4_fix" /><check system="C-59423r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Open an elevated Windows PowerShell prompt on a DNS server using the Domain Admin or Enterprise Admin account.
 
@@ -619,15 +621,16 @@ Right-click Analytical and then click on Properties.
 
 Confirm the "Enable logging" check box is selected.
 
-If the check box to enable analytic and debug logs is not enabled on a Windows 2012 R2 DNS server, this is a finding.</check-content></check></Rule></Group><Group id="V-58573"><title>SRG-APP-000125-DNS-000012</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73003r3_rule" severity="medium" weight="10.0"><version>WDNS-AU-000016</version><title>The Windows 2012 DNS Servers audit records must be backed up at least every seven days onto a different system or system component than the system or component being audited.</title><description>&lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on a defined frequency helps to assure, in the event of a catastrophic system failure, the audit records will be retained.
+If the check box to enable analytic and debug logs is not enabled on a Windows 2012 R2 DNS server, this is a finding.</check-content></check></Rule></Group><Group id="V-58573"><title>SRG-APP-000125-DNS-000012</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73003r4_rule" severity="medium" weight="10.0"><version>WDNS-AU-000016</version><title>The Windows 2012 DNS Servers audit records must be backed up at least every seven days onto a different system or system component than the system or component being audited.</title><description>&lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on a defined frequency helps to assure, in the event of a catastrophic system failure, the audit records will be retained.
 
 This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records.
 
-This requirement only applies to applications that have a native backup capability for audit records. Operating system backup requirements cover applications that do not provide native backup functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001348</ident><fixtext fixref="F-63957r2_fix">Document and implement a backup policy to back up the DNS Server's audit records at least every seven days.</fixtext><fix id="F-63957r2_fix" /><check system="C-59445r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the System Administrator to determine the backup policy in place for Windows 2008 DNS Server.
+This requirement only applies to applications that have a native backup capability for audit records. Operating system backup requirements cover applications that do not provide native backup functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001348</ident><fixtext fixref="F-63957r2_fix">Document and implement a backup policy to back up the DNS Server's audit records at least every seven days.</fixtext><fix id="F-63957r2_fix" /><check system="C-59445r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the System Administrator to determine the backup policy in place for Windows DNS Server.
 
 Review the backup methods used and determine if the backup's methods have been successful at backing up the audit records at least every seven days.
 
-If the organization does not have a backup policy in place for backing up the Windows 2008 DNS Server's audit records and/or the backup methods have not been successful at backing up the audit records at least every seven days, this is a finding.</check-content></check></Rule></Group><Group id="V-58575"><title>SRG-APP-000214-DNS-000079</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73005r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000001</version><title>The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week.</title><description>&lt;VulnDiscussion&gt;The best way for a zone administrator to minimize the impact of a key compromise is by limiting the validity period of RRSIGs in the zone and in the parent zone. This strategy limits the time during which an attacker can take advantage of a compromised key to forge responses. An attacker that has compromised a ZSK can use that key only during the KSK's signature validity interval. An attacker that has compromised a KSK can use that key for only as long as the signature interval of the RRSIG covering the DS RR in the delegating parent. These validity periods should be short, which will require frequent re-signing.
+If the organization does not have a backup policy in place for backing up the Windows DNS Server's audit records and/or the backup methods have not been successful at backing up the audit records at least every seven days, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58575"><title>SRG-APP-000214-DNS-000079</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73005r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000001</version><title>The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week.</title><description>&lt;VulnDiscussion&gt;The best way for a zone administrator to minimize the impact of a key compromise is by limiting the validity period of RRSIGs in the zone and in the parent zone. This strategy limits the time during which an attacker can take advantage of a compromised key to forge responses. An attacker that has compromised a ZSK can use that key only during the KSK's signature validity interval. An attacker that has compromised a KSK can use that key for only as long as the signature interval of the RRSIG covering the DS RR in the delegating parent. These validity periods should be short, which will require frequent re-signing.
 
 To prevent the impact of a compromised KSK, a delegating parent should set the signature validity period for RRSIGs covering DS RRs in the range of a few days to 1 week. This re-signing does not require frequent rollover of the parent's ZSK, but scheduled ZSK rollover should still be performed at regular intervals.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63959r3_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
@@ -651,15 +654,16 @@ From the expanded list, click to select the zone.
 
 View the validity period for the DS Resource Record.
 
-If the validity period for the DS Resource Record for the child domain is less than two days (48 hours) or more than one week (168 hours), this is a finding.</check-content></check></Rule></Group><Group id="V-58577"><title>SRG-APP-000218-DNS-000027</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73007r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000002</version><title>The Windows DNS name servers for a zone must be geographically dispersed.</title><description>&lt;VulnDiscussion&gt;In addition to network-based separation, authoritative name servers should be dispersed geographically as well. In other words, in addition to being located on different network segments, the authoritative name servers should not all be located within the same building. One approach that some organizations follow is to locate some authoritative name servers in their own premises and others in their ISPs' data centers or in partnering organizations.
+If the validity period for the DS Resource Record for the child domain is less than two days (48 hours) or more than one week (168 hours), this is a finding.</check-content></check></Rule></Group><Group id="V-58577"><title>SRG-APP-000218-DNS-000027</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73007r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000002</version><title>The Windows DNS name servers for a zone must be geographically dispersed.</title><description>&lt;VulnDiscussion&gt;In addition to network-based separation, authoritative name servers should be dispersed geographically as well. In other words, in addition to being located on different network segments, the authoritative name servers should not all be located within the same building. One approach that some organizations follow is to locate some authoritative name servers in their own premises and others in their ISPs' data centers or in partnering organizations.
 
-A network administrator may choose to use a "hidden" master authoritative server and only have secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone.  If the master authoritative name server is "hidden", a secondary authoritative name server may reside in the same building as the hidden master.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63961r7_fix">For non-AD-integrated Windows 2008 DNS servers, distribute secondary authoritative servers to be located in different buildings from the primary authoritative server.</fixtext><fix id="F-63961r7_fix" /><check system="C-59449r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Windows 2008 DNS Servers that are Active Directory integrated must be located where required to meet the Active Directory services.
+A network administrator may choose to use a "hidden" master authoritative server and only have secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone.  If the master authoritative name server is "hidden", a secondary authoritative name server may reside in the same building as the hidden master.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63961r8_fix">For non-AD-integrated Windows DNS Servers, distribute secondary authoritative servers to be located in different buildings from the primary authoritative server.   </fixtext><fix id="F-63961r8_fix" /><check system="C-59449r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Windows DNS Servers that are Active Directory integrated must be located where required to meet the Active Directory services.
 
-If all of the Windows 2008 DNS Servers are AD integrated, this check is Not Applicable.
+If all of the Windows DNS Servers are AD integrated, this check is Not Applicable.
 
-If any or all of the Windows 2008 DNS Servers are standalone and non-AD-integrated, verify with the System Administrator their geographic location.
+If any or all of the Windows DNS Servers are standalone and non-AD-integrated, verify with the System Administrator their geographic location.
 
-If any or all of the authoritative name servers are located in the same building as the master authoritative name server, and the master authoritative name server is not "hidden", this is a finding.</check-content></check></Rule></Group><Group id="V-58579"><title>SRG-APP-000383-DNS-000047</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73009r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000003</version><title>The Windows 2012 DNS Server must prohibit recursion on authoritative name servers for which forwarders have not been configured for external queries.</title><description>&lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords.
+If any or all of the authoritative name servers are located in the same building as the master authoritative name server, and the master authoritative name server is not "hidden", this is a finding.
+</check-content></check></Rule></Group><Group id="V-58579"><title>SRG-APP-000383-DNS-000047</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73009r5_rule" severity="medium" weight="10.0"><version>WDNS-CM-000003</version><title>The Windows 2012 DNS Server must prohibit recursion on authoritative name servers for which forwarders have not been configured for external queries.</title><description>&lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords.
 
 To guard against poisoning, name servers authoritative for .mil domains should be separated functionally from name servers that resolve queries on behalf of internal clients. Organizations may achieve this separation by dedicating machines to each function or, if possible, by running two instances of the name server software on the same machine: one for the authoritative function and the other for the resolving function. In this design, each name server process may be bound to a different IP address or network interface to implement the required segregation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63963r2_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
@@ -671,9 +675,9 @@ Click on the “Forwarders” tab.
 
 If forwarders are not being used, click the “Advanced” tab.
 
-Select the "Disable recursion (also disables forwarders)" check box.</fixtext><fix id="F-63963r2_fix" /><check system="C-59451r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
+Select the "Disable recursion (also disables forwarders)" check box.</fixtext><fix id="F-63963r2_fix" /><check system="C-59451r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
 
-Note: In Windows 2008 DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
+Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
 
 If forwarders are not used, recursion must be disabled.
 
@@ -692,7 +696,7 @@ If forwarders are enabled and configured, this check is not applicable.
 If forwarders are not enabled, click on the “Advanced” tab and ensure the "Disable recursion (also disables forwarders)" check box is selected.
 
 If forwarders are not enabled and configured, and the "Disable recursion (also disables forwarders)" check box in the “Advanced” tab is not selected, this is a finding.
-</check-content></check></Rule></Group><Group id="V-58581"><title>SRG-APP-000383-DNS-000047</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73011r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000004</version><title>Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS).</title><description>&lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords.
+</check-content></check></Rule></Group><Group id="V-58581"><title>SRG-APP-000383-DNS-000047</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73011r5_rule" severity="medium" weight="10.0"><version>WDNS-CM-000004</version><title>Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS).</title><description>&lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords.
 
 To guard against poisoning, name servers authoritative for .mil domains should be separated functionally from name servers that resolve queries on behalf of internal clients. Organizations may achieve this separation by dedicating machines to each function or, if possible, by running two instances of the name server software on the same machine: one for the authoritative function and the other for the resolving function. In this design, each name server process may be bound to a different IP address or network interface to implement the required segregation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63965r2_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
@@ -704,9 +708,9 @@ Click on the “Forwarders” tab.
 
 Replace the forwarders being used with another DoD-managed DNS server or the DoD Enterprise Recursive Services (ERS).
 
-Deselect the "Use root hints if no forwarders are available".</fixtext><fix id="F-63965r2_fix" /><check system="C-59453r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
+Deselect the "Use root hints if no forwarders are available".</fixtext><fix id="F-63965r2_fix" /><check system="C-59453r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
 
-Note: In Windows 2008 DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
+Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
 
 If forwarders are not used, recursion must be disabled. In both cases, the use of root hints must be disabled.
 
@@ -725,10 +729,10 @@ Review the IP address(es) for the forwarder(s) use.
 If the DNS Server does not forward to another DoD-managed DNS server or to the DoD Enterprise Recursive Services (ERS), this is a finding.
 
 If the "Use root hints if no forwarders are available" is selected, this is a finding.
-</check-content></check></Rule></Group><Group id="V-58583"><title>SRG-APP-000383-DNS-000047</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73013r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000005</version><title>The Windows 2012 DNS Server with a caching name server role must restrict recursive query responses to only the IP addresses and IP address ranges of known supported clients.</title><description>&lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords.
+</check-content></check></Rule></Group><Group id="V-58583"><title>SRG-APP-000383-DNS-000047</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73013r5_rule" severity="medium" weight="10.0"><version>WDNS-CM-000005</version><title>The Windows 2012 DNS Server with a caching name server role must restrict recursive query responses to only the IP addresses and IP address ranges of known supported clients.</title><description>&lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords.
 
-To guard against poisoning, name servers specifically fulfilling the role of providing recursive query responses for external zones need to be segregated from name servers authoritative for internal zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63967r2_fix">Configure a local or network firewall to only allow specific IP addresses/ranges to send inbound TCP and UDP port 53 traffic to a DNS caching server.</fixtext><fix id="F-63967r2_fix" /><check system="C-59455r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If Windows DNS server is not serving in a caching role, this check is Not Applicable.
-Verify the Windows 2008 DNS Server will only accept TCP and UDP port 53 traffic from specific IP addresses/ranges.
+To guard against poisoning, name servers specifically fulfilling the role of providing recursive query responses for external zones need to be segregated from name servers authoritative for internal zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63967r2_fix">Configure a local or network firewall to only allow specific IP addresses/ranges to send inbound TCP and UDP port 53 traffic to a DNS caching server.</fixtext><fix id="F-63967r2_fix" /><check system="C-59455r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If Windows DNS server is not serving in a caching role, this check is Not Applicable.
+Verify the Windows DNS Server will only accept TCP and UDP port 53 traffic from specific IP addresses/ranges.
 
 This can be configured via a local or network firewall.
 
@@ -862,7 +866,7 @@ All of the zone's resource records will be returned, among which should be the N
 If NSEC3 RRs are not returned for the zone, this is a finding.
 
 2vf77rkf63hrgismnuvnb8... NSEC3      0                    01:00:00        [RsaSha1][False][50][F2738D980008F73C]
-7ceje475rse25gppr3vphs... NSEC3      0                    01:00:00        [RsaSha1][False][50][F2738D980008F73C]</check-content></check></Rule></Group><Group id="V-58593"><title>SRG-APP-000516-DNS-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73023r4_rule" severity="high" weight="10.0"><version>WDNS-CM-000010</version><title>The Windows 2012 DNS Servers zone files must have NS records that point to active name servers authoritative for the domain specified in that record.</title><description>&lt;VulnDiscussion&gt;Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly specified in the zone file. The adversary could issue bogus responses to queries that clients would accept because they learned of the adversary's name server from a valid authoritative name server, one that need not be compromised for this attack to be successful. The list of slave servers must remain current within 72 hours of any changes to the zone architecture that would affect the list of slaves. If a slave server has been retired or is not operational but remains on the list, then an adversary might have a greater opportunity to impersonate that slave without detection, rather than if the slave was actually online. For example, the adversary may be able to spoof the retired slave's IP address without an IP address conflict, which would not be likely to occur if the true slave were active.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63977r2_fix">If DNS servers are AD-integrated, troubleshoot and remedy the replication problem where the non-responsive name server is not getting updated.
+7ceje475rse25gppr3vphs... NSEC3      0                    01:00:00        [RsaSha1][False][50][F2738D980008F73C]</check-content></check></Rule></Group><Group id="V-58593"><title>SRG-APP-000516-DNS-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73023r5_rule" severity="high" weight="10.0"><version>WDNS-CM-000010</version><title>The Windows 2012 DNS Servers zone files must have NS records that point to active name servers authoritative for the domain specified in that record.</title><description>&lt;VulnDiscussion&gt;Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly specified in the zone file. The adversary could issue bogus responses to queries that clients would accept because they learned of the adversary's name server from a valid authoritative name server, one that need not be compromised for this attack to be successful. The list of slave servers must remain current within 72 hours of any changes to the zone architecture that would affect the list of slaves. If a slave server has been retired or is not operational but remains on the list, then an adversary might have a greater opportunity to impersonate that slave without detection, rather than if the slave was actually online. For example, the adversary may be able to spoof the retired slave's IP address without an IP address conflict, which would not be likely to occur if the true slave were active.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63977r2_fix">If DNS servers are AD-integrated, troubleshoot and remedy the replication problem where the non-responsive name server is not getting updated.
 
 If DNS servers are not AD-integrated, log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
@@ -874,7 +878,7 @@ From the expanded list, click to select the zone.
 
 Review the NS records for the zone.
 
-Select the NS record for the non-responsive name server and remove the record.</fixtext><fix id="F-63977r2_fix" /><check system="C-59465r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>NOTE: This check is Not Applicable if Windows DNS server is only serving as a caching server and does not host any zones authoritatively.
+Select the NS record for the non-responsive name server and remove the record.</fixtext><fix id="F-63977r2_fix" /><check system="C-59465r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>NOTE: This check is Not Applicable if Windows DNS server is only serving as a caching server and does not host any zones authoritatively.
 Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Press “Windows Key + R”, execute “dnsmgmt.msc”.
@@ -893,21 +897,23 @@ nslookup &lt;enter&gt;;
 
 At the nslookup prompt, type:
 
-server=###.###.###.### &lt;enter&gt;;
+server ###.###.###.### &lt;enter&gt;;
 (where the ###.###.###.### is replaced by the IP of each NS record)
 
 Enter a FQDN for a known host record in the zone.
 
 If the NS server does not respond at all or responds with a non-authoritative answer, this is a finding.
-</check-content></check></Rule></Group><Group id="V-58595"><title>SRG-APP-000516-DNS-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73025r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000012</version><title>All authoritative name servers for a zone must be located on different network segments.</title><description>&lt;VulnDiscussion&gt;Most enterprises have an authoritative primary server and a host of authoritative secondary name servers. It is essential that these authoritative name servers for an enterprise be located on different network segments. This dispersion ensures the availability of an authoritative name server not only in situations in which a particular router or switch fails but also during events involving an attack on an entire network segment.
+</check-content></check></Rule></Group><Group id="V-58595"><title>SRG-APP-000516-DNS-000087</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73025r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000012</version><title>All authoritative name servers for a zone must be located on different network segments.</title><description>&lt;VulnDiscussion&gt;Most enterprises have an authoritative primary server and a host of authoritative secondary name servers. It is essential that these authoritative name servers for an enterprise be located on different network segments. This dispersion ensures the availability of an authoritative name server not only in situations in which a particular router or switch fails but also during events involving an attack on an entire network segment.
 
-A network administrator may choose to use a "hidden" master authoritative server and only have secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. If the master authoritative name server is "hidden", a secondary authoritative name server may reside on the same network as the hidden master.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63979r2_fix">For non-AD-integrated Windows 2008 DNS Servers, distribute secondary authoritative servers on separate network segments from the primary authoritative server.</fixtext><fix id="F-63979r2_fix" /><check system="C-59467r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Windows 2008 DNS Servers that are Active Directory-integrated must be located where required to meet the Active Directory services.
+A network administrator may choose to use a "hidden" master authoritative server and only have secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. If the master authoritative name server is "hidden", a secondary authoritative name server may reside on the same network as the hidden master.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63979r3_fix">For non-AD-integrated Windows DNS Servers, distribute secondary authoritative servers on separate network segments from the primary authoritative server.   </fixtext><fix id="F-63979r3_fix" /><check system="C-59467r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Windows DNS Servers that are Active Directory-integrated must be located where required to meet the Active Directory services.
 
-If all of the Windows 2008 DNS Servers are AD-integrated, this check is not applicable.
+If all of the Windows DNS Servers are AD-integrated, this check is not applicable.
 
-If any or all of the Windows 2008 DNS Servers are stand-alone and non-AD-integrated, verify with the System Administrator their geographic dispersal.
+If any or all of the Windows DNS Servers are stand-alone and non-AD-integrated, verify with the System Administrator their geographic dispersal.
 
-If all of the authoritative name servers are located on the same network segment, and the master authoritative name server is not "hidden", this is a finding.</check-content></check></Rule></Group><Group id="V-58597"><title>SRG-APP-000516-DNS-000088</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73027r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000013</version><title>All authoritative name servers for a zone must have the same version of zone information.</title><description>&lt;VulnDiscussion&gt;The only protection approach for content control of a DNS zone file is the use of a zone file integrity checker. The effectiveness of integrity checking using a zone file integrity checker depends upon the database of constraints built into the checker. The deployment process consists of developing these constraints with the right logic, and the only determinant of the truth value of these logical predicates is the parameter values for certain key fields in the format of various RRTypes.
+If all of the authoritative name servers are located on the same network segment, and the master authoritative name server is not "hidden", this is a finding.
+
+</check-content></check></Rule></Group><Group id="V-58597"><title>SRG-APP-000516-DNS-000088</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73027r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000013</version><title>All authoritative name servers for a zone must have the same version of zone information.</title><description>&lt;VulnDiscussion&gt;The only protection approach for content control of a DNS zone file is the use of a zone file integrity checker. The effectiveness of integrity checking using a zone file integrity checker depends upon the database of constraints built into the checker. The deployment process consists of developing these constraints with the right logic, and the only determinant of the truth value of these logical predicates is the parameter values for certain key fields in the format of various RRTypes.
 
 The serial number in the SOA RDATA is used to indicate to secondary name servers that a change to the zone has occurred and a zone transfer should be performed. It should always be increased whenever a change is made to the zone data. DNS NOTIFY must be enabled on the master authoritative name server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63981r2_fix">If all DNS servers are AD-integrated, troubleshoot why and mitigate the replication is not taking place to the out-of-sync secondary name servers.
 
@@ -1015,27 +1021,30 @@ For each zone, review the records.
 
 If any RRs (Resource Records) on an internal DNS server resolve to IP addresses located outside the internal DNS server's network, this is a finding.
 
-If any RRs (Resource Records) on an external DNS server resolve to IP addresses located inside the network, this is a finding.</check-content></check></Rule></Group><Group id="V-58605"><title>SRG-APP-000516-DNS-000092</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73035r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000017</version><title>In a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.</title><description>&lt;VulnDiscussion&gt;Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers.
+If any RRs (Resource Records) on an external DNS server resolve to IP addresses located inside the network, this is a finding.</check-content></check></Rule></Group><Group id="V-58605"><title>SRG-APP-000516-DNS-000092</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73035r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000017</version><title>In a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.</title><description>&lt;VulnDiscussion&gt;Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers.
 
 One set, called external name servers, can be located within a DMZ; these would be the only name servers that are accessible to external clients and would serve RRs pertaining to hosts with public services (Web servers that serve external Web pages or provide B2C services, mail servers, etc.)
 
-The other set, called internal name servers, is to be located within the firewall and should be configured so they are not reachable from outside and hence provide naming services exclusively to internal clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63989r2_fix">Configure the external DNS server's firewall policy, or the network firewall, to block queries from internal hosts.</fixtext><fix id="F-63989r2_fix" /><check system="C-59477r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the System Administrator to review the external Windows 2008 DNS Server's HBSS firewall policy.
+The other set, called internal name servers, is to be located within the firewall and should be configured so they are not reachable from outside and hence provide naming services exclusively to internal clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63989r2_fix">Configure the external DNS server's firewall policy, or the network firewall, to block queries from internal hosts.</fixtext><fix id="F-63989r2_fix" /><check system="C-59477r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the System Administrator to review the external Windows DNS Server's HBSS firewall policy.
 
 The inbound TCP and UDP ports 53 rule should be configured to only restrict IP addresses from the internal network.
 
 If the HBSS firewall policy is not configured with the restriction, consult with the network firewall administrator to confirm the restriction on the network firewall.
 
-If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block internal hosts from querying the external DNS server, this is a finding.</check-content></check></Rule></Group><Group id="V-58607"><title>SRG-APP-000516-DNS-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73037r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000018</version><title>In a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.</title><description>&lt;VulnDiscussion&gt;Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers.
+If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block internal hosts from querying the external DNS server, this is a finding.
+
+</check-content></check></Rule></Group><Group id="V-58607"><title>SRG-APP-000516-DNS-000093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73037r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000018</version><title>In a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.</title><description>&lt;VulnDiscussion&gt;Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers.
 
 One set, called external name servers, can be located within a DMZ; these would be the only name servers that are accessible to external clients and would serve RRs pertaining to hosts with public services (Web servers that serve external Web pages or provide B2C services, mail servers, etc.)
 
-The other set, called internal name servers, is to be located within the firewall and should be configured so they are not reachable from outside and hence provide naming services exclusively to internal clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63991r2_fix">Configure the internal DNS server's firewall policy, or the network firewall, to block queries from external hosts.</fixtext><fix id="F-63991r2_fix" /><check system="C-59479r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the System Administrator to review the internal Windows 2008 DNS Server's HBSS firewall policy.
+The other set, called internal name servers, is to be located within the firewall and should be configured so they are not reachable from outside and hence provide naming services exclusively to internal clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63991r2_fix">Configure the internal DNS server's firewall policy, or the network firewall, to block queries from external hosts.</fixtext><fix id="F-63991r2_fix" /><check system="C-59479r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the System Administrator to review the internal Windows DNS Server's HBSS firewall policy.
 
 The inbound TCP and UDP ports 53 rule should be configured to only allow hosts from the internal network to query the internal DNS server.
 
 If the HBSS firewall policy is not configured with the restriction, consult with the network firewall administrator to confirm the restriction on the network firewall.
 
-If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block external hosts from querying the internal DNS server, this is a finding.</check-content></check></Rule></Group><Group id="V-58609"><title>SRG-APP-000516-DNS-000095</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73039r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000019</version><title>Primary authoritative name servers must be configured to only receive zone transfer requests from specified secondary name servers.</title><description>&lt;VulnDiscussion&gt;Authoritative name servers (especially primary name servers) should be configured with an allow-transfer access control sub statement designating the list of hosts from which zone transfer requests can be accepted. These restrictions address the denial-of-service threat and potential exploits from unrestricted dissemination of information about internal resources. Based on the need-to-know, the only name servers that need to refresh their zone files periodically are the secondary name servers. Zone transfer from primary name servers should be restricted to secondary name servers. The zone transfer should be completely disabled in the secondary name servers. The address match list argument for the allow-transfer sub statement should consist of IP addresses of secondary name servers and stealth secondary name servers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63993r2_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block external hosts from querying the internal DNS server, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58609"><title>SRG-APP-000516-DNS-000095</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73039r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000019</version><title>Primary authoritative name servers must be configured to only receive zone transfer requests from specified secondary name servers.</title><description>&lt;VulnDiscussion&gt;Authoritative name servers (especially primary name servers) should be configured with an allow-transfer access control sub statement designating the list of hosts from which zone transfer requests can be accepted. These restrictions address the denial-of-service threat and potential exploits from unrestricted dissemination of information about internal resources. Based on the need-to-know, the only name servers that need to refresh their zone files periodically are the secondary name servers. Zone transfer from primary name servers should be restricted to secondary name servers. The zone transfer should be completely disabled in the secondary name servers. The address match list argument for the allow-transfer sub statement should consist of IP addresses of secondary name servers and stealth secondary name servers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-63993r2_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Press Windows Key + R, execute dnsmgmt.msc.
 
@@ -1135,9 +1144,10 @@ Right-click the DNS server, select “Properties”.
 Select the "Root Hints" tab.
 Verify the "Root Hints" is either empty or only has entries for internal zones under "Name servers:". All Internet root server entries must be removed.
 If "Root Hints" is not empty or entries on the "Root Hints" tab under "Name servers:" are external to the local network, this is a finding.
-</check-content></check></Rule></Group><Group id="V-58617"><title>SRG-APP-000516-DNS-000103</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73047r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000023</version><title>The DNS name server software must be at the latest version.</title><description>&lt;VulnDiscussion&gt;Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. These vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. It makes good business sense to run the latest version of name server software because theoretically it is the safest version. Even if the software is the latest version, it is not safe to run it in default mode. The security administrator should always configure the software to run in the recommended secure mode of operation after becoming familiar with the new security settings for the latest version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64001r2_fix">Apply all related Microsoft Operating System IAVM patches to the DNS server.</fixtext><fix id="F-64001r2_fix" /><check system="C-59489r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the network IAVM scanner to confirm all Microsoft Operating System IAVMs applicable to Windows 2008/2008 R2 have been applied to the DNS server.
+</check-content></check></Rule></Group><Group id="V-58617"><title>SRG-APP-000516-DNS-000103</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73047r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000023</version><title>The DNS name server software must be at the latest version.</title><description>&lt;VulnDiscussion&gt;Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. These vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. It makes good business sense to run the latest version of name server software because theoretically it is the safest version. Even if the software is the latest version, it is not safe to run it in default mode. The security administrator should always configure the software to run in the recommended secure mode of operation after becoming familiar with the new security settings for the latest version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64001r2_fix">Apply all related Microsoft Operating System IAVM patches to the DNS server.</fixtext><fix id="F-64001r2_fix" /><check system="C-59489r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Consult with the network IAVM scanner to confirm all Microsoft Operating System IAVMs have been applied to the Windows DNS server.
 
-If the Windows Operating System has not been patched to handle all IAVMs, this is a finding.</check-content></check></Rule></Group><Group id="V-58619"><title>SRG-APP-000516-DNS-000113</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73049r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000024</version><title>The Windows 2012 DNS Servers zone files must not include resource records that resolve to a fully qualified domain name residing in another zone.</title><description>&lt;VulnDiscussion&gt;If a name server were able to claim authority for a resource record in a domain for which it was not authoritative, this would pose a security risk. In this environment, an adversary could use illicit control of a name server to impact IP address resolution beyond the scope of that name server (i.e., by claiming authority for records outside of that server's zones). Fortunately, all but the oldest versions of BIND and most other DNS implementations do not allow for this behavior. Nevertheless, the best way to eliminate this risk is to eliminate from the zone files any records for hosts in another zone.
+If all Microsoft Operating System IAVMs have not been applied to the DNS server, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58619"><title>SRG-APP-000516-DNS-000113</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73049r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000024</version><title>The Windows 2012 DNS Servers zone files must not include resource records that resolve to a fully qualified domain name residing in another zone.</title><description>&lt;VulnDiscussion&gt;If a name server were able to claim authority for a resource record in a domain for which it was not authoritative, this would pose a security risk. In this environment, an adversary could use illicit control of a name server to impact IP address resolution beyond the scope of that name server (i.e., by claiming authority for records outside of that server's zones). Fortunately, all but the oldest versions of BIND and most other DNS implementations do not allow for this behavior. Nevertheless, the best way to eliminate this risk is to eliminate from the zone files any records for hosts in another zone.
 
 The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms.  In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64003r1_fix">Remove any resource records in a zone file if the resource record resolves to a fully qualified domain name residing in another zone.</fixtext><fix id="F-64003r1_fix" /><check system="C-59491r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
@@ -1151,9 +1161,9 @@ Confirm with the DNS administrator that the hosts defined in the zone files do n
 
 The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms. In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated. Additional exceptions are CNAME records in a multi-domain Active Directory environment pointing to hosts in other internal domains in the same multi-domain environment.
 
-If resource records are maintained that resolve to a fully qualified domain name in another zone, and the usage is not for resource records resolving to hosts that are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with a documented and approved mission need, this is a finding.</check-content></check></Rule></Group><Group id="V-58621"><title>SRG-APP-000516-DNS-000114</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73051r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000025</version><title>The Windows 2012 DNS Servers zone files must not include CNAME records pointing to a zone with lesser security for more than six months.</title><description>&lt;VulnDiscussion&gt;The use of CNAME records for exercises, tests, or zone-spanning aliases should be temporary (e.g., to facilitate a migration). When a host name is an alias for a record in another zone, an adversary has two points of attack: the zone in which the alias is defined and the zone authoritative for the alias's canonical name. This configuration also reduces the speed of client resolution because it requires a second lookup after obtaining the canonical name. Furthermore, in the case of an authoritative name server, this information is promulgated throughout the enterprise to caching servers and thus compounds the vulnerability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64005r2_fix">Remove any zone-spanning CNAME records that have been active for more than six months, which are not supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms.
+If resource records are maintained that resolve to a fully qualified domain name in another zone, and the usage is not for resource records resolving to hosts that are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with a documented and approved mission need, this is a finding.</check-content></check></Rule></Group><Group id="V-58621"><title>SRG-APP-000516-DNS-000114</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73051r4_rule" severity="medium" weight="10.0"><version>WDNS-CM-000025</version><title>The Windows 2012 DNS Servers zone files must not include CNAME records pointing to a zone with lesser security for more than six months.</title><description>&lt;VulnDiscussion&gt;The use of CNAME records for exercises, tests, or zone-spanning (pointing to zones with lesser security) aliases should be temporary (e.g., to facilitate a migration) and not be in place for more than six months. When a host name is an alias for a record in another zone, an adversary has two points of attack: the zone in which the alias is defined and the zone authoritative for the alias's canonical name. This configuration also reduces the speed of client resolution because it requires a second lookup after obtaining the canonical name. Furthermore, in the case of an authoritative name server, this information is promulgated throughout the enterprise to caching servers and thus compounds the vulnerability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64005r2_fix">Remove any zone-spanning CNAME records that have been active for more than six months, which are not supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms.
 
-In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated (AO approval of use of a commercial cloud offering would satisfy this requirement).</fixtext><fix id="F-64005r2_fix" /><check system="C-59493r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated (AO approval of use of a commercial cloud offering would satisfy this requirement).</fixtext><fix id="F-64005r2_fix" /><check system="C-59493r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Press Windows Key + R, execute dnsmgmt.msc.
 
@@ -1165,7 +1175,8 @@ Review the RRs to confirm that there are no CNAME records older than 6 months.
 
 The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms. In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated (AO approval of use of a commercial cloud offering would satisfy this requirement). Additional exceptions are CNAME records in a multi-domain Active Directory environment pointing to hosts in other internal domains in the same multi-domain environment.
 
-If there are zone-spanning CNAME records older than 6 months and the CNAME records resolve to anything other than fully qualified domain names for glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with an AO-approved and documented mission need, this is a finding.</check-content></check></Rule></Group><Group id="V-58623"><title>SRG-APP-000516-DNS-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73053r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000026</version><title>Non-routable IPv6 link-local scope addresses must not be configured in any zone.</title><description>&lt;VulnDiscussion&gt;IPv6 link-local scope addresses are not globally routable and must not be configured in any DNS zone.  Similar to RFC1918 addresses, if a link-local scope address is inserted into a zone provided to clients, most routers will not forward this traffic beyond the local subnet.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64007r2_fix">The SA should remove any link-local addresses and replace with appropriate Site-Local or Global scope addresses.</fixtext><fix id="F-64007r2_fix" /><check system="C-59495r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+If there are zone-spanning (i.e., zones of lesser security)CNAME records older than 6 months and the CNAME records resolve to anything other than fully qualified domain names for glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with an AO-approved and documented mission need, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58623"><title>SRG-APP-000516-DNS-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73053r3_rule" severity="medium" weight="10.0"><version>WDNS-CM-000026</version><title>Non-routable IPv6 link-local scope addresses must not be configured in any zone.</title><description>&lt;VulnDiscussion&gt;IPv6 link-local scope addresses are not globally routable and must not be configured in any DNS zone.  Similar to RFC1918 addresses, if a link-local scope address is inserted into a zone provided to clients, most routers will not forward this traffic beyond the local subnet.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64007r2_fix">The SA should remove any link-local addresses and replace with appropriate Site-Local or Global scope addresses.</fixtext><fix id="F-64007r2_fix" /><check system="C-59495r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Press Windows Key + R, execute dnsmgmt.msc.
 
@@ -1191,12 +1202,19 @@ Verify if any contain both IPv4 and IPv6 addresses.
 
 If any hostnames contain both IPv4 and IPv6 addresses, confirm with the SA that the actual hosts are IPv6-aware.
 
-If any zone contains hosts with both IPv4 and IPv6 addresses but are determined to be non-IPv6-aware, this is a finding.</check-content></check></Rule></Group><Group id="V-58627"><title>SRG-APP-000516-DNS-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73057r5_rule" severity="medium" weight="10.0"><version>WDNS-CM-000028</version><title>When IPv6 protocol is installed, the server must also be configured to answer for IPv6 AAAA records.</title><description>&lt;VulnDiscussion&gt;To prevent the possibility of a denial of service in relation to an IPv4 DNS server trying to respond to IPv6 requests, the server should be configured not to listen on any of its IPv6 interfaces unless it does contain IPv6 AAAA resource records in one of the zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64011r3_fix">Log onto the DNS server.
+If any zone contains hosts with both IPv4 and IPv6 addresses but are determined to be non-IPv6-aware, this is a finding.</check-content></check></Rule></Group><Group id="V-58627"><title>SRG-APP-000516-DNS-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73057r7_rule" severity="medium" weight="10.0"><version>WDNS-CM-000028</version><title>IPv6 protocol must be disabled unless the Windows 2012 DNS server is configured to answer for and hosting IPv6 AAAA records.</title><description>&lt;VulnDiscussion&gt;To prevent the possibility of a denial of service in relation to an IPv4 DNS server trying to respond to IPv6 requests, the server should be configured not to listen on any of its IPv6 interfaces unless it does contain IPv6 AAAA resource records in one of the zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><fixtext fixref="F-64011r4_fix">Log onto the DNS server.
 
 Access Group Policy Management.
 
 Edit Default Domain Policy, go to Computer Configuration &gt;&gt; Policies &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; IPv6 Configuration, Open IPv6 Configuration Policy and set on “Disable all IPv6 components”.
-</fixtext><fix id="F-64011r3_fix" /><check system="C-59499r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+
+As an alternative to using the GPO setting, the registry setting may also be altered directly to reflect:
+HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters \
+Set the value for “DisabledComponents” to “255 (0xff)”.
+
+</fixtext><fix id="F-64011r4_fix" /><check system="C-59499r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If the Windows 2012 DNS server is hosting IPv6 records, this requirement is not applicable.
+
+Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 From a command prompt, run regedit.
 In the User Account Control dialog box, click Continue.
@@ -1269,7 +1287,7 @@ Verify the Type: is Active Directory-Integrated.
 
 Verify the Dynamic updates has "Secure only" selected.
 
-If the zone is Active Directory-Integrated and the Dynamic updates are not configured for "Secure only", this is a finding.</check-content></check></Rule></Group><Group id="V-58633"><title>SRG-APP-000158-DNS-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73063r3_rule" severity="medium" weight="10.0"><version>WDNS-IA-000002</version><title>The Windows 2012 DNS Server must uniquely identify the other DNS server before responding to a server-to-server transaction.</title><description>&lt;VulnDiscussion&gt;Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions only and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair (TSIG) or using PKI-based authentication (SIG(0)), thus uniquely identifying the other server.
+If the zone is Active Directory-Integrated and the Dynamic updates are not configured for "Secure only", this is a finding.</check-content></check></Rule></Group><Group id="V-58633"><title>SRG-APP-000158-DNS-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73063r4_rule" severity="medium" weight="10.0"><version>WDNS-IA-000002</version><title>The Windows 2012 DNS Server must uniquely identify the other DNS server before responding to a server-to-server transaction.</title><description>&lt;VulnDiscussion&gt;Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions only and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair (TSIG) or using PKI-based authentication (SIG(0)), thus uniquely identifying the other server.
 
 TSIG and SIG(0) are not configurable in Windows 2012 DNS Server.
 
@@ -1305,9 +1323,9 @@ From the "CA name:", click “Browse” and select the certificate for the CA, c
 
 On Profile, accept default selections, click “Next”.
 
-On Name, enter a name applicable to the rule's function, click “Finish”.</fixtext><fix id="F-64017r5_fix" /><check system="C-59505r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: This requirement applies to any Windows 2008 DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
+On Name, enter a name applicable to the rule's function, click “Finish”.</fixtext><fix id="F-64017r5_fix" /><check system="C-59505r8_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: This requirement applies to any Windows DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
 
-If the Windows 2008 DNS Servers only host AD-integrated zones, this requirement is not applicable.
+If the Windows DNS Servers only host AD-integrated zones, this requirement is not applicable.
 
 Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account.
 
@@ -1333,7 +1351,8 @@ On the “Remote Computers” tab, Endpoint1 and Endpoint2 are configured with t
 
 On the “Protocols and Ports” tab, "Protocol type:" is set to either TCP (depending upon which rule is being reviewed) and the "Endpoint 1 port:" is set to "Specific ports" and "53".
 
-If there are not rules(s) configured with the specified requirements, this is a finding.</check-content></check></Rule></Group><Group id="V-58635"><title>SRG-APP-000394-DNS-000049</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73065r4_rule" severity="medium" weight="10.0"><version>WDNS-IA-000003</version><title>The secondary Windows DNS name servers must cryptographically authenticate zone transfers from primary name servers.</title><description>&lt;VulnDiscussion&gt;Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Device authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.
+If there are not rules(s) configured with the specified requirements, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58635"><title>SRG-APP-000394-DNS-000049</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73065r4_rule" severity="medium" weight="10.0"><version>WDNS-IA-000003</version><title>The secondary Windows DNS name servers must cryptographically authenticate zone transfers from primary name servers.</title><description>&lt;VulnDiscussion&gt;Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Device authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.
 
 This requirement applies to server-to-server (zone transfer) transactions only and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair (TSIG) or using PKI-based authentication (SIG(0)).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001958</ident><fixtext fixref="F-64019r2_fix">Sign, or re-sign, the hosted zone(s) on the DNS server being validated.
 
@@ -1482,7 +1501,7 @@ Section: Answer
 IP4Address: ###.###.###.###
 
 If the results do not show the RRSIG and signature information, this is a finding.
-</check-content></check></Rule></Group><Group id="V-58641"><title>SRG-APP-000176-DNS-000017</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73071r3_rule" severity="medium" weight="10.0"><version>WDNS-IA-000006</version><title>The Windows 2012 DNS Server must be configured to enforce authorized access to the corresponding private key.</title><description>&lt;VulnDiscussion&gt;The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.
+</check-content></check></Rule></Group><Group id="V-58641"><title>SRG-APP-000176-DNS-000017</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73071r4_rule" severity="medium" weight="10.0"><version>WDNS-IA-000006</version><title>The Windows 2012 DNS Server must be configured to enforce authorized access to the corresponding private key.</title><description>&lt;VulnDiscussion&gt;The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.
 
 SIG(0) is used for server-to-server authentication for DNS transactions, and it uses PKI-based authentication. So, in cases where SIG(0) is being used instead of TSIG (which uses a shared key, not PKI-based authentication), this requirement is applicable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-64025r3_fix">Access Windows Explorer.
 
@@ -1490,15 +1509,18 @@ Navigate to the following location:
 
 %ALLUSERSPROFILE%\Microsoft\Crypto
 
-Modify permissions on the keys folder, sub-folders, and files to be limited to SYSTEM and Administrators FULL CONTROL and to all other Users/Groups to READ.</fixtext><fix id="F-64025r3_fix" /><check system="C-59513r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Access Windows Explorer.
+Modify permissions on the keys folder, sub-folders, and files to be limited to SYSTEM and Administrators FULL CONTROL and to all other Users/Groups to READ.</fixtext><fix id="F-64025r3_fix" /><check system="C-59513r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Access Windows Explorer.
 
 Navigate to the following location:
 
 %ALLUSERSPROFILE%\Microsoft\Crypto
+Note: If the %ALLUSERSPROFILE%\Microsoft\Crypto folder doesn't exist, this is not applicable.
 
 Verify the permissions on the keys folder, sub-folders, and files are limited to SYSTEM and Administrators FULL CONTROL.
 
-If any other user or group has greater than READ privileges to the %ALLUSERSPROFILE%\Microsoft\Crypto folder, sub-folders and files, this is a finding.</check-content></check></Rule></Group><Group id="V-58643"><title>SRG-APP-000176-DNS-000018</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73073r3_rule" severity="medium" weight="10.0"><version>WDNS-IA-000007</version><title>The Windows 2012 DNS Server key file must be owned by the account under which the Windows 2012 DNS Server service is run.</title><description>&lt;VulnDiscussion&gt;To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key can also be used for securing other transactions, such as dynamic updates, DNS queries, and responses. The binary key string that is generated by most key generation utilities used with DNSSEC is Base64-encoded. TSIG is a string used to generate the message authentication hash stored in a TSIG RR and used to authenticate an entire DNS message.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-64027r5_fix">Access Windows Explorer.
+If any other user or group has greater than READ privileges to the %ALLUSERSPROFILE%\Microsoft\Crypto folder, sub-folders and files, this is a finding.
+
+</check-content></check></Rule></Group><Group id="V-58643"><title>SRG-APP-000176-DNS-000018</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73073r4_rule" severity="medium" weight="10.0"><version>WDNS-IA-000007</version><title>The Windows 2012 DNS Server key file must be owned by the account under which the Windows 2012 DNS Server service is run.</title><description>&lt;VulnDiscussion&gt;To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key can also be used for securing other transactions, such as dynamic updates, DNS queries, and responses. The binary key string that is generated by most key generation utilities used with DNSSEC is Base64-encoded. TSIG is a string used to generate the message authentication hash stored in a TSIG RR and used to authenticate an entire DNS message.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-64027r5_fix">Access Windows Explorer.
 
 Navigate to the following location:
 
@@ -1507,7 +1529,7 @@ Navigate to the following location:
 Right-click on each sub-folder, choose “Properties”, click on the “Security” tab, and click on the “Advanced” button.
 
 Click on "Change" next to the listed Owner and change to be the account under which the DNS Server Service is running.
-</fixtext><fix id="F-64027r5_fix" /><check system="C-59515r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Access Services on the Windows DNS Server and locate the DNS Server Service.
+</fixtext><fix id="F-64027r5_fix" /><check system="C-59515r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Access Services on the Windows DNS Server and locate the DNS Server Service.
 
 Determine the account under which the DNS Server Service is running.
 
@@ -1516,27 +1538,28 @@ Access Windows Explorer.
 Navigate to the following location:
 
 %ALLUSERSPROFILE%\Microsoft\Crypto
+Note: If the %ALLUSERSPROFILE%\Microsoft\Crypto folder doesn't exist, this is not applicable.
 
 Right-click on each sub-folder, choose “Properties”, click on the “Security” tab, and click on the “Advanced” button.
 
 Verify the Owner on the folder, sub-folders, and files are the account under which the DNS Server Service is running.
 
 If any other user or group is listed as OWNER of the %ALLUSERSPROFILE%\Microsoft\Crypto folder, sub-folders, and files, this is a finding.
-</check-content></check></Rule></Group><Group id="V-58645"><title>SRG-APP-000176-DNS-000019</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73075r5_rule" severity="medium" weight="10.0"><version>WDNS-IA-000008</version><title>The Windows 2012 DNS Server permissions must be set so that the key file can only be read or modified by the account that runs the name server software.</title><description>&lt;VulnDiscussion&gt;To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key can also be used for securing other transactions, such as dynamic updates, DNS queries, and responses. The binary key string that is generated by most key generation utilities used with DNSSEC is Base64-encoded. TSIG is a string used to generate the message authentication hash stored in a TSIG RR and used to authenticate an entire DNS message.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-64029r3_fix">Access Windows Explorer.
+</check-content></check></Rule></Group><Group id="V-58645"><title>SRG-APP-000176-DNS-000019</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73075r6_rule" severity="medium" weight="10.0"><version>WDNS-IA-000008</version><title>The Windows 2012 DNS Server permissions must be set so that the key file can only be read or modified by the account that runs the name server software.</title><description>&lt;VulnDiscussion&gt;To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key can also be used for securing other transactions, such as dynamic updates, DNS queries, and responses. The binary key string that is generated by most key generation utilities used with DNSSEC is Base64-encoded. TSIG is a string used to generate the message authentication hash stored in a TSIG RR and used to authenticate an entire DNS message.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-64029r3_fix">Access Windows Explorer.
 
 Navigate to the following location:
 %ALLUSERSPROFILE%\Microsoft\Crypto
 
 Modify permissions on the folder, sub-folders and files to “FULL CONTROL” for “SYSTEM” and Administrators  and to “READ” for all other Users/Groups.
-</fixtext><fix id="F-64029r3_fix" /><check system="C-59517r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Access Windows Explorer.
+</fixtext><fix id="F-64029r3_fix" /><check system="C-59517r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Access Windows Explorer.
 
 Navigate to the following location:
 %ALLUSERSPROFILE%\Microsoft\Crypto
+Note: If the %ALLUSERSPROFILE%\Microsoft\Crypto folder doesn't exist, this is not applicable.
 
 Verify the permissions on the folder, sub-folders and files are limited to “SYSTEM” and Administrators for “FULL CONTROL”.
 
 If any other user or group has greater than READ permissions to the %ALLUSERSPROFILE%\Microsoft\Crypto folder, sub-folders and files, this is a finding.
-
 </check-content></check></Rule></Group><Group id="V-58647"><title>SRG-APP-000176-DNS-000094</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73077r4_rule" severity="medium" weight="10.0"><version>WDNS-IA-000009</version><title>The private key corresponding to the ZSK must only be stored on the name server that does support dynamic updates.</title><description>&lt;VulnDiscussion&gt;The private keys in the KSK and ZSK key pairs must be protected from unauthorized access. If possible, the private keys should be stored off-line (with respect to the Internet-facing, DNSSEC-aware name server) in a physically secure, non-network-accessible machine along with the zone file master copy.
 
 This strategy is not feasible in situations in which the DNSSEC-aware name server has to support dynamic updates. To support dynamic update transactions, the DNSSEC-aware name server (which usually is a primary authoritative name server) has to have both the zone file master copy and the private key corresponding to the zone-signing key (ZSK-private) online to immediately update the signatures for the updated RRsets. The private key corresponding to the key-signing key (KSK-private) can still be kept off-line.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000186</ident><fixtext fixref="F-64031r1_fix">Ensure the private key corresponding to the ZSK is only stored on the name server accepting dynamic updates.</fixtext><fix id="F-64031r1_fix" /><check system="C-59519r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network.
@@ -2539,7 +2562,7 @@ Determine how and where backed up data is being stored.
 Verify the protection of the backup medium is secured to the same level, or higher, as the server itself.
 
 If a backup policy does not exist or the backup policy does not specify the protection required for backup medium to be at or above the same level as the server, this is a finding.
-</check-content></check></Rule></Group><Group id="V-58695"><title>SRG-APP-000428-DNS-000061</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73125r3_rule" severity="medium" weight="10.0"><version>WDNS-SC-000025</version><title>The Windows 2012 DNS Server must not contain zone records that have not been validated in over a year.</title><description>&lt;VulnDiscussion&gt;If zone information has not been validated in over a year, then there is no assurance that it is still valid.  If invalid records are in a zone, then an adversary could potentially use their existence for improper purposes. An SOP detailing this process can resolve this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002475</ident><fixtext fixref="F-64079r3_fix">Create a separate database to maintain record documentation for non-AD-integrated zones.
+</check-content></check></Rule></Group><Group id="V-58695"><title>SRG-APP-000428-DNS-000061</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73125r4_rule" severity="medium" weight="10.0"><version>WDNS-SC-000025</version><title>The Windows 2012 DNS Server must not contain zone records that have not been validated in over a year.</title><description>&lt;VulnDiscussion&gt;If zone information has not been validated in over a year, then there is no assurance that it is still valid.  If invalid records are in a zone, then an adversary could potentially use their existence for improper purposes. An SOP detailing this process can resolve this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002475</ident><fixtext fixref="F-64079r3_fix">Create a separate database to maintain record documentation for non-AD-integrated zones.
 
 Develop a procedure to validate annually all zone information on the DNS server against the separately maintained database.
 
@@ -2551,9 +2574,9 @@ On the opened DNS Manager snap-in from the left pane, expand the server name for
 
 From the expanded list, click to select the zone.
 
-Select the zone records which have not been validated in over a year and revalidate.</fixtext><fix id="F-64079r3_fix" /><check system="C-59567r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>This requirement is not applicable for a Windows 2008 DNS Server which is only hosting AD-integrated zones.
+Select the zone records which have not been validated in over a year and revalidate.</fixtext><fix id="F-64079r3_fix" /><check system="C-59567r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>This requirement is not applicable for a Windows DNS Server which is only hosting AD-integrated zones.
 
-For a Windows 2008 DNS Server which hosts a mix of AD-integrated zones and manually maintained zones, ask the DNS database administrator if they maintain a separate database with record documentation for the non-AD-integrated zone information. The reviewer should check that the record's last verified date is less than one year prior to the date of the review.
+For a Windows DNS Server which hosts a mix of AD-integrated zones and manually maintained zones, ask the DNS database administrator if they maintain a separate database with record documentation for the non-AD-integrated zone information. The reviewer should check that the record's last verified date is less than one year prior to the date of the review.
 
 If a separate database with record documentation is not maintained for the non-AD-integrated zone information, this is a finding.
 
@@ -2569,7 +2592,8 @@ Review the zone records of the non-AD-integrated zones and compare to the separa
 
 Determine if any records have not been validated in over a year.
 
-If zone records exist which have not been validated in over a year, this is a finding.</check-content></check></Rule></Group><Group id="V-58697"><title>SRG-APP-000246-DNS-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73127r3_rule" severity="medium" weight="10.0"><version>WDNS-SC-000026</version><title>The Windows 2012 DNS Server must restrict individuals from using it for launching Denial of Service (DoS) attacks against other information systems.</title><description>&lt;VulnDiscussion&gt;Applications and application developers must take the steps needed to ensure users cannot use an authorized application to launch DoS attacks against other systems and networks. For example, applications may include mechanisms that throttle network traffic so users are not able to generate unlimited network traffic via the application. Limiting system resources that are allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-64081r2_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; "Allow log on through Remote Desktop Services" to only include the following accounts or groups:
+If zone records exist which have not been validated in over a year, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58697"><title>SRG-APP-000246-DNS-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73127r3_rule" severity="medium" weight="10.0"><version>WDNS-SC-000026</version><title>The Windows 2012 DNS Server must restrict individuals from using it for launching Denial of Service (DoS) attacks against other information systems.</title><description>&lt;VulnDiscussion&gt;Applications and application developers must take the steps needed to ensure users cannot use an authorized application to launch DoS attacks against other systems and networks. For example, applications may include mechanisms that throttle network traffic so users are not able to generate unlimited network traffic via the application. Limiting system resources that are allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001094</ident><fixtext fixref="F-64081r2_fix">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; "Allow log on through Remote Desktop Services" to only include the following accounts or groups:
 
 Administrators
 
@@ -2829,33 +2853,38 @@ If all of the DNS servers are AD-integrated, this is not a finding.
 
 Consult with the System Administrator to determine if there are documented procedures for re-roling a non-AD-integrated secondary name server to a master name server role in the event a master name server loses functionality.
 
-If there is not any documented procedures for re-roling a non-AD-integrated secondary name server to primary in the event a master name server loses functionality, this is a finding.</check-content></check></Rule></Group><Group id="V-58711"><title>SRG-APP-000268-DNS-000039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73141r3_rule" severity="medium" weight="10.0"><version>WDNS-SI-000005</version><title>The Windows 2012 DNS Server must, when a component failure is detected, activate a notification to the system administrator.</title><description>&lt;VulnDiscussion&gt;Predictable failure prevention requires organizational planning to address system failure issues. If components key to maintaining systems security fail to function, the system could continue operating in an insecure state. The organization must be prepared, and the application must support requirements that specify if the application must alarm for such conditions and/or automatically shut down the application or the system.
+If there is not any documented procedures for re-roling a non-AD-integrated secondary name server to primary in the event a master name server loses functionality, this is a finding.</check-content></check></Rule></Group><Group id="V-58711"><title>SRG-APP-000268-DNS-000039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73141r4_rule" severity="medium" weight="10.0"><version>WDNS-SI-000005</version><title>The Windows 2012 DNS Server must, when a component failure is detected, activate a notification to the system administrator.</title><description>&lt;VulnDiscussion&gt;Predictable failure prevention requires organizational planning to address system failure issues. If components key to maintaining systems security fail to function, the system could continue operating in an insecure state. The organization must be prepared, and the application must support requirements that specify if the application must alarm for such conditions and/or automatically shut down the application or the system.
 
 This can include conducting a graceful application shutdown to avoid losing information. Automatic or manual transfer of components from standby to active mode can occur, for example, upon detection of component failures.
 
-If a component such as the DNSSEC or TSIG/SIG(0) signing capabilities were to fail, the DNS server should shut itself down to prevent continued execution without the necessary security components in place. Transactions such as zone transfers would not be able to work correctly anyway in this state.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-001328</ident><fixtext fixref="F-64095r3_fix">Implement a third-party monitoring system to detect and notify the system administrator upon component failure or, at a minimum, document and implement a procedure to review the diagnostic logs on a routine basis every day.</fixtext><fix id="F-64095r3_fix" /><check system="C-59585r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Notification to system administrator is not configurable in Windows 2008. In order for system administrators to be notified when a component fails, the system administrator would need to implement a third-party monitoring system. At a minimum, the system administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
+If a component such as the DNSSEC or TSIG/SIG(0) signing capabilities were to fail, the DNS server should shut itself down to prevent continued execution without the necessary security components in place. Transactions such as zone transfers would not be able to work correctly anyway in this state.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-001328</ident><fixtext fixref="F-64095r3_fix">Implement a third-party monitoring system to detect and notify the system administrator upon component failure or, at a minimum, document and implement a procedure to review the diagnostic logs on a routine basis every day.</fixtext><fix id="F-64095r3_fix" /><check system="C-59585r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Notification to system administrator is not configurable in Windows DNS Server. In order for system administrators to be notified when a component fails, the system administrator would need to implement a third-party monitoring system. At a minimum, the system administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
 
-If a third-party monitoring system is not in place to detect and notify the system administrator upon component failures and the system administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.</check-content></check></Rule></Group><Group id="V-58713"><title>SRG-APP-000473-DNS-000072</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73143r3_rule" severity="medium" weight="10.0"><version>WDNS-SI-000006</version><title>The Windows 2012 DNS Server must perform verification of the correct operation of security functions: upon system start-up and/or restart; upon command by a user with privileged access; and/or every 30 days.</title><description>&lt;VulnDiscussion&gt;Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Without verification, security functions may not operate correctly and this failure may go unnoticed.
+If a third-party monitoring system is not in place to detect and notify the system administrator upon component failures and the system administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58713"><title>SRG-APP-000473-DNS-000072</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73143r4_rule" severity="medium" weight="10.0"><version>WDNS-SI-000006</version><title>The Windows 2012 DNS Server must perform verification of the correct operation of security functions: upon system start-up and/or restart; upon command by a user with privileged access; and/or every 30 days.</title><description>&lt;VulnDiscussion&gt;Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Without verification, security functions may not operate correctly and this failure may go unnoticed.
 
 Notifications provided by information systems include, for example, electronic alerts to system administrators, messages to local computer consoles, and/or hardware indications, such as lights.
 
-The DNS server should perform self-tests, such as at server start-up, to confirm that its security functions are working properly.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-002775</ident><fixtext fixref="F-64097r2_fix">Follow the HBSS guidance to install all HBSS products to the Windows 2008 DNS server.</fixtext><fix id="F-64097r2_fix" /><check system="C-59587r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>This functionality should be performed by the Host Based Security System (HBSS), mandatory on all DoD systems.
+The DNS server should perform self-tests, such as at server start-up, to confirm that its security functions are working properly.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000366</ident><ident system="http://iase.disa.mil/cci">CCI-002775</ident><fixtext fixref="F-64097r3_fix">Follow the HBSS guidance to install all HBSS products to the Windows DNS Server.   </fixtext><fix id="F-64097r3_fix" /><check system="C-59587r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>This functionality should be performed by the Host Based Security System (HBSS), mandatory on all DoD systems.
 
-Check to ensure McAfee HBSS is installed and fully operational on the Windows 2008 DNS Server.
+Check to ensure McAfee HBSS is installed and fully operational on the Windows DNS Server.
 
-If all required HBSS products are not installed and/or the installed products are not enabled, this is a finding.</check-content></check></Rule></Group><Group id="V-58715"><title>SRG-APP-000474-DNS-000073</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73145r3_rule" severity="medium" weight="10.0"><version>WDNS-SI-000007</version><title>The Windows 2012 DNS Server must log the event and notify the system administrator when anomalies in the operation of the signed zone transfers are discovered.</title><description>&lt;VulnDiscussion&gt;Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights.
+If all required HBSS products are not installed and/or the installed products are not enabled, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58715"><title>SRG-APP-000474-DNS-000073</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73145r4_rule" severity="medium" weight="10.0"><version>WDNS-SI-000007</version><title>The Windows 2012 DNS Server must log the event and notify the system administrator when anomalies in the operation of the signed zone transfers are discovered.</title><description>&lt;VulnDiscussion&gt;Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights.
 
 If anomalies are not acted upon, security functions may fail to secure the system.
 
-The DNS server does not have the capability of shutting down or restarting the information system. The DNS server can be configured to generate audit records when anomalies are discovered, and the OS/NDM can then trigger notification messages to the system administrator based on the presence of those audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002699</ident><fixtext fixref="F-64099r1_fix">Implement a third-party monitoring system to detect and notify the ISSO/ISSM/DNS administrator if functionality of DNSSEC/TSIG has been removed or broken or, at a minimum, document and implement a procedure to review the diagnostic logs on a routine basis every day.</fixtext><fix id="F-64099r1_fix" /><check system="C-59589r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Notification to system administrator is not configurable in Windows 2012. In order for administrator to be notified if functionality of DNSSEC/TSIG has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third-party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
+The DNS server does not have the capability of shutting down or restarting the information system. The DNS server can be configured to generate audit records when anomalies are discovered, and the OS/NDM can then trigger notification messages to the system administrator based on the presence of those audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002699</ident><fixtext fixref="F-64099r1_fix">Implement a third-party monitoring system to detect and notify the ISSO/ISSM/DNS administrator if functionality of DNSSEC/TSIG has been removed or broken or, at a minimum, document and implement a procedure to review the diagnostic logs on a routine basis every day.</fixtext><fix id="F-64099r1_fix" /><check system="C-59589r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: If only zones hosted are AD-integrated zones, this check is not applicable.
+
+Notification to system administrator is not configurable in Windows 2012. In order for administrator to be notified if functionality of DNSSEC/TSIG has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third-party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
 
-If a third-party monitoring system is not in place to detect and notify the ISSO/ISSM/DNS administrator if functionality of DNSSEC/TSIG has been removed or broken and the ISSO/ISSM/DNS administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.</check-content></check></Rule></Group><Group id="V-58717"><title>SRG-APP-000275-DNS-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73147r4_rule" severity="medium" weight="10.0"><version>WDNS-SI-000008</version><title>The Windows 2012 DNS Server must be configured to notify the ISSO/ISSM/DNS administrator when functionality of DNSSEC/TSIG has been removed or broken.</title><description>&lt;VulnDiscussion&gt;Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. If personnel are not notified of failed security verification tests, they will not be able to take corrective action and the unsecure condition(s) will remain. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights.
+If a third-party monitoring system is not in place to detect and notify the ISSO/ISSM/DNS administrator if functionality of DNSSEC/TSIG has been removed or broken and the ISSO/ISSM/DNS administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.</check-content></check></Rule></Group><Group id="V-58717"><title>SRG-APP-000275-DNS-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73147r5_rule" severity="medium" weight="10.0"><version>WDNS-SI-000008</version><title>The Windows 2012 DNS Server must be configured to notify the ISSO/ISSM/DNS administrator when functionality of DNSSEC/TSIG has been removed or broken.</title><description>&lt;VulnDiscussion&gt;Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. If personnel are not notified of failed security verification tests, they will not be able to take corrective action and the unsecure condition(s) will remain. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights.
 
-The DNS server should be configured to generate audit records whenever a self-test fails. The OS/NDM is responsible for generating notification messages related to this audit record.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001294</ident><fixtext fixref="F-64101r2_fix">Implement a third-party monitoring system to detect and notify the ISSO/ISSM/DNS administrator if functionality of Secure Updates has been removed or broken or, at a minimum, document and implement a procedure to review the diagnostic logs on a routine basis every day.</fixtext><fix id="F-64101r2_fix" /><check system="C-59591r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network.
+The DNS server should be configured to generate audit records whenever a self-test fails. The OS/NDM is responsible for generating notification messages related to this audit record.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001294</ident><fixtext fixref="F-64101r2_fix">Implement a third-party monitoring system to detect and notify the ISSO/ISSM/DNS administrator if functionality of Secure Updates has been removed or broken or, at a minimum, document and implement a procedure to review the diagnostic logs on a routine basis every day.</fixtext><fix id="F-64101r2_fix" /><check system="C-59591r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Microsoft_Windows_2012_Server_Domain_Name_System_STIG.xml" /><check-content>Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network.
 
-Notification to system administrator is not configurable in Windows 2008. In order for ISSO/ISSM/DNS administrator to be notified if functionality of Secure Updates has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
+Notification to system administrator is not configurable in Windows DNS Server. In order for ISSO/ISSM/DNS administrator to be notified if functionality of Secure Updates has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
 
-If a third party monitoring system is not in place to detect and notify the ISSO/ISSM/DNS administrator if functionality of Secure Updates has been removed or broken and the ISSO/ISSM/DNS administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.</check-content></check></Rule></Group><Group id="V-58719"><title>SRG-APP-000504-DNS-000074</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73149r3_rule" severity="medium" weight="10.0"><version>WDNS-SI-000009</version><title>The Windows 2012 DNS Server must generate audit records for the success and failure of start and stop of the DNS Server service.</title><description>&lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being performed on the system, where an event occurred, when an event occurred, and by whom the event was triggered, in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, to recognize resource utilization or capacity thresholds, or to simply identify an improperly configured DNS system. If auditing is not comprehensive, it will not be useful for intrusion monitoring, security investigations, and forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002702</ident><fixtext fixref="F-64103r1_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+If a third party monitoring system is not in place to detect and notify the ISSO/ISSM/DNS administrator if functionality of Secure Updates has been removed or broken and the ISSO/ISSM/DNS administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.
+</check-content></check></Rule></Group><Group id="V-58719"><title>SRG-APP-000504-DNS-000074</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-73149r3_rule" severity="medium" weight="10.0"><version>WDNS-SI-000009</version><title>The Windows 2012 DNS Server must generate audit records for the success and failure of start and stop of the DNS Server service.</title><description>&lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being performed on the system, where an event occurred, when an event occurred, and by whom the event was triggered, in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, to recognize resource utilization or capacity thresholds, or to simply identify an improperly configured DNS system. If auditing is not comprehensive, it will not be useful for intrusion monitoring, security investigations, and forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 2012 DNS</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 2012 DNS</dc:subject><dc:identifier>2771</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-002702</ident><fixtext fixref="F-64103r1_fix">Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 Press Windows Key + R, execute dnsmgmt.msc.
 
diff --git a/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.log b/source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.log
rename to source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.xml b/source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.DNS/U_Microsoft_Windows_2012_Server_DNS_V1R13_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.log b/source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.xml b/source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R7_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R6_Manual-xccdf.log b/source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.log
similarity index 53%
rename from StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R6_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.log
index 06707da29..fc31f046b 100644
--- a/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R6_Manual-xccdf.log
+++ b/source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.log
@@ -1,8 +1,9 @@
+V-75147::If the value "PUAProtection" does not exist, this is a finding.::""
 V-75237::Values of 0x0 through 0x7 are acceptable and not a finding.::Values of 0 through 7 are acceptable and not a finding.
 V-75167::REG_DWORD = 2 or REG_DWORD = 1::REG_DWORD = 2(or 1)
-V-75153::For Windows Server 2016:::blank1
+V-75153::For Windows Server 2016/Windows Server 2019:::blank1
 V-75153::Note: This only applies when a third-party antivirus solution is enforced on the system.::blank2
-V-75153::Due to changes from Microsoft in the Server 2016 architecture, Windows Defender Antivirus will not disable itself when other antivirus products are detected. Microsoft has also removed API's for other Antivirus software to cleanly stop and disable Windows Defender AV. This was a design choice by Microsoft to maximize protection in Server 2016.::blank3
+V-75153::Due to changes from Microsoft in the Server 2016/Server 2019 architecture, Windows Defender Antivirus will not disable itself when other antivirus products are detected. Microsoft has also removed API's for other Antivirus software to cleanly stop and disable Windows Defender AV. This was a design choice by Microsoft to maximize protection in Server 2016/Server 2019.::blank3
 V-75153::If there is a third-party antivirus product enforced on the system, the Windows Defender Antivirus must be uninstalled.::blank4
 V-75153::Procedure: Access Add Roles and Features Wizard >> Features::blank5
 V-75153::Criteria: If “Windows Defender Features (Installed) is selected, this is a finding.::blank6
diff --git a/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R6_Manual-xccdf.xml b/source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.xml
similarity index 79%
rename from StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R6_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.xml
index 205b2bab2..5dfc7c08f 100644
--- a/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R6_Manual-xccdf.xml
+++ b/source/StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.xml
@@ -1,54 +1,55 @@
-<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Windows_Defender_Antivirus" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2019-06-24">accepted</status><title>MS Windows Defender Antivirus Security Technical Implementation Guide</title><description>The Windows Defender Antivirus Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.  Comments or proposed revisions to this document should be send via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 6 Benchmark Date: 26 Jul 2019</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Group id="V-75147"><title>SRG-APP-000279</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89827r2_rule" severity="high" weight="10.0"><version>WNDF-AV-000001</version><title>Windows Defender AV must be configured to enable the Potentially Unwanted Application (PUA) feature.</title><description>&lt;VulnDiscussion&gt;After enabling this feature, Potentially Unwanted Application (PUA) protection blocking takes effect on endpoint clients after the next signature update or computer restart. Signature updates take place daily under typical circumstances. PUA will be blocked and automatically quarantined.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001243</ident><fixtext fixref="F-81759r3_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; MS Security Guide -&gt; "Turn on Windows Defender protection against Potentially Unwanted Applications" to “Enabled”.
+<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Windows_Defender_Antivirus" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-19">accepted</status><title>MS Windows Defender Antivirus Security Technical Implementation Guide</title><description>The Windows Defender Antivirus Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.  Comments or proposed revisions to this document should be send via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="https://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 8 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Group id="V-75147"><title>SRG-APP-000279</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89827r3_rule" severity="high" weight="10.0"><version>WNDF-AV-000001</version><title>Windows Defender AV must be configured to block the Potentially Unwanted Application (PUA) feature.</title><description>&lt;VulnDiscussion&gt;After enabling this feature, PUA protection blocking takes effect on endpoint clients after the next signature update or computer restart. Signature updates take place daily under typical circumstances. PUA will be blocked and automatically quarantined.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001243</ident><fixtext fixref="F-81759r4_fix">Set the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; "Configure Detection for Potentially Unwanted Applications" to "Enabled" and "Block".</fixtext><fix id="F-81759r4_fix" /><check system="C-74939r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; "Configure detection for potentially unwanted applications" is set to "Enabled" and "Block".
 
-This policy setting requires the installation of the SecGuide custom templates included with the Windows 10 STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.
-</fixtext><fix id="F-81759r3_fix" /><check system="C-74939r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; MS Security Guide -&gt; "Turn on Windows Defender protection against Potentially Unwanted Applications" is set to "Enabled".
+Use the Windows Registry Editor to navigate to the following key:
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
-HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine
+HKLM\Software\Policies\Microsoft\Windows Defender
+
+If the value "PUAProtection" does not exist, this is a finding.
+
+If the value "PUAProtection" is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-75151"><title>SRG-APP-000279</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89831r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000003</version><title>Windows Defender AV must be configured to automatically take action on all detected tasks.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure whether Windows Defender automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action user-defined action and the signature-defined action. If you enable this policy setting Windows Defender does not automatically take action on the detected threats but prompts users to choose from the actions available for each threat. If you disable or do not configure this policy setting Windows Defender automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001243</ident><fixtext fixref="F-81763r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; "Turn off routine remediation" to "Disabled" or "Not Configured".</fixtext><fix id="F-81763r2_fix" /><check system="C-74943r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; "Turn off routine remediation" is set to "Disabled" or "Not Configured".
 
-Criteria: If the value "MpEnablePus" is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-75151"><title>SRG-APP-000279</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89831r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000003</version><title>Windows Defender AV must be configured to automatically take action on all detected tasks.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure whether Windows Defender automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action user-defined action and the signature-defined action. If you enable this policy setting Windows Defender does not automatically take action on the detected threats but prompts users to choose from the actions available for each threat. If you disable or do not configure this policy setting Windows Defender automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001243</ident><fixtext fixref="F-81763r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; "Turn off routine remediation" to "Disabled" or "Not Configured".</fixtext><fix id="F-81763r2_fix" /><check system="C-74943r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; "Turn off routine remediation" is set to "Disabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender
 
 Criteria: If the value "DisableRoutinelyTakingAction" is REG_DWORD = 0, this is not a finding.
 
 If the value does not exist, this is not a finding.
 
-If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75153"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89833r4_rule" severity="high" weight="10.0"><version>WNDF-AV-000004</version><title>Windows Defender AV must be configured to run and scan for malware and other potentially unwanted software.</title><description>&lt;VulnDiscussion&gt;This policy setting turns off Windows Defender Antivirus. If you enable this policy setting Windows Defender Antivirus does not run and computers are not scanned for malware or other potentially unwanted software. When the setting is Disabled and a third-party antivirus solution is installed, the two applications can both simultaneously try to protect the system. The two AV solutions both attempt to quarantine the same threat and will fight for access to delete the file. Users will see conflicts and the system may lock up until the two solutions finish processing. When the setting is Not Configured and a third-party antivirus solution is installed, both applications co-exist on the system without conflicts.  Defender Antivirus will automatically disable itself and will enable if the third-party solution stops functioning.  When the setting is Not Configured and Defender Antivirus is the only AV solution, Defender AV will run (default state) and receive definition updates.  An administrator account is needed to turn off the service.  A standard user cannot disable the service. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81765r4_fix">For Windows 10: Set the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus set "Turn off Windows Defender Antivirus" to "Not Configured".   
+If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75153"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89833r5_rule" severity="high" weight="10.0"><version>WNDF-AV-000004</version><title>Windows Defender AV must be configured to run and scan for malware and other potentially unwanted software.</title><description>&lt;VulnDiscussion&gt;This policy setting turns off Windows Defender Antivirus. If you enable this policy setting Windows Defender Antivirus does not run and computers are not scanned for malware or other potentially unwanted software. When the setting is Disabled and a third-party antivirus solution is installed, the two applications can both simultaneously try to protect the system. The two AV solutions both attempt to quarantine the same threat and will fight for access to delete the file. Users will see conflicts and the system may lock up until the two solutions finish processing. When the setting is Not Configured and a third-party antivirus solution is installed, both applications co-exist on the system without conflicts.  Defender Antivirus will automatically disable itself and will enable if the third-party solution stops functioning.  When the setting is Not Configured and Defender Antivirus is the only AV solution, Defender AV will run (default state) and receive definition updates.  An administrator account is needed to turn off the service.  A standard user cannot disable the service. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81765r5_fix">For Windows 10: Set the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus set "Turn off Windows Defender Antivirus" to "Not Configured".
 
-For Windows 2016: Use the following PowerShell cmdlet to uninstall Windows Defender AV on Windows 2016:
+For Windows 2016/Windows 2019: Use the following PowerShell cmdlet to uninstall Windows Defender AV on Windows 2016/Windows 2019:
 Uninstall-WindowsFeature -Name Windows-Defender
-</fixtext><fix id="F-81765r4_fix" /><check system="C-74945r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; "Turn off Windows Defender Antivirus" is set to “Not Configured”.
+
+</fixtext><fix id="F-81765r5_fix" /><check system="C-74945r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; "Turn off Windows Defender Antivirus" is set to “Not Configured”.
 
 For Windows 10:
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender
 
 Criteria: If the value "DisableAntiSpyware" does not exist, this is not a finding.
 
-For Windows Server 2016:
+For Windows Server 2016/Windows Server 2019:
 Note: This only applies when a third-party antivirus solution is enforced on the system.
-Due to changes from Microsoft in the Server 2016 architecture, Windows Defender Antivirus will not disable itself when other antivirus products are detected. Microsoft has also removed API's for other Antivirus software to cleanly stop and disable Windows Defender AV. This was a design choice by Microsoft to maximize protection in Server 2016. 
+Due to changes from Microsoft in the Server 2016/Server 2019 architecture, Windows Defender Antivirus will not disable itself when other antivirus products are detected. Microsoft has also removed API's for other Antivirus software to cleanly stop and disable Windows Defender AV. This was a design choice by Microsoft to maximize protection in Server 2016/Server 2019.
 
-If there is a third-party antivirus product enforced on the system, the Windows Defender Antivirus must be uninstalled. 
+If there is a third-party antivirus product enforced on the system, the Windows Defender Antivirus must be uninstalled.
 
 Procedure: Access Add Roles and Features Wizard &gt;&gt; Features
 
 Criteria: If “Windows Defender Features (Installed) is selected, this is a finding.
 </check-content></check></Rule></Group><Group id="V-75155"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89835r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000005</version><title>Windows Defender AV must be configured to not exclude files for scanning.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair where the name should be a string representation of a path or a fully qualified resource name. As an example a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81767r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Exclusions -&gt; "Path Exclusions" to "Disabled" or "Not Configured".</fixtext><fix id="F-81767r2_fix" /><check system="C-74947r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Exclusions -&gt; "Path Exclusions" is set to "Disabled" or "Not Configured.
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Exclusions
- 
+
 Criteria: If the value "Exclusions_Paths" does not exist, this is not a finding.</check-content></check></Rule></Group><Group id="V-75157"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89837r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000006</version><title>Windows Defender AV must be configured to not exclude files opened by specified processes.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself will not be excluded. To exclude the process use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81769r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Exclusions -&gt; "Process Exclusions" to "Disabled" or "Not Configured".</fixtext><fix id="F-81769r2_fix" /><check system="C-74949r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Exclusions -&gt; "Process Exclusions" is set to "Disabled" or "Not Configured".
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Exclusions
 
 Criteria: If the value "Exclusions_Processes" does not exist, this is not a finding.</check-content></check></Rule></Group><Group id="V-75159"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89839r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000007</version><title>Windows Defender AV must be configured to enable the Automatic Exclusions feature.</title><description>&lt;VulnDiscussion&gt;Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81771r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Exclusions -&gt; "Turn off Auto Exclusions" to "Disabled".</fixtext><fix id="F-81771r1_fix" /><check system="C-74951r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Exclusions -&gt; "Turn off Auto Exclusions" is set to "Disabled".
-     
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Exclusions
 
 Criteria: If the value "DisableAutoExclusions" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75161"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89841r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000008</version><title>Windows Defender AV must be configured to disable local setting override for reporting to Microsoft MAPS.</title><description>&lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81773r4_fix">This is applicable to unclassified systems, for other systems this is NA.
@@ -56,8 +57,8 @@ Criteria: If the value "DisableAutoExclusions" is REG_DWORD = 0, this is not a f
 Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; MAPS -&gt; "Configure local setting override for reporting to Microsoft MAPS" to "Disabled" or "Not Configured".</fixtext><fix id="F-81773r4_fix" /><check system="C-74953r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA.
 
 Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; MAPS -&gt; "Configure local setting override for reporting to Microsoft MAPS" is set to "Disabled" or "Not Configured".
-     
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Spynet
 
 Criteria: If the value "LocalSettingOverrideSpynetReporting" is REG_DWORD = 0, this is not a finding.
@@ -69,34 +70,36 @@ If the value is 1, this is a finding.</check-content></check></Rule></Group><Gro
 Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; MAPS -&gt; "Configure the 'Block at First Sight' feature" to "Enabled".</fixtext><fix id="F-81775r3_fix" /><check system="C-74957r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA.
 
 Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; MAPS -&gt; "Configure the 'Block at First Sight' feature" is set to "Enabled".
-     
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Spynet
 
-Criteria: If the value "DisableBlockAtFirstSeen" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75167"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89847r4_rule" severity="medium" weight="10.0"><version>WNDF-AV-000010</version><title>Windows Defender AV must be configured to not join Microsoft MAPS.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default)  (0x1) Basic membership (0x2) Advanced membership    Basic membership will send basic information to Microsoft about software that has been detected including where the software came from the actions that you apply or that are applied automatically and whether the actions were successful. Advanced membership in addition to basic information will send more information to Microsoft about malicious software spyware and potentially unwanted software including the location of the software file names how the software operates and how it has impacted your computer. If you enable this setting you will join Microsoft MAPS with the membership specified. If you disable or do not configure this setting you will not join Microsoft MAPS. In Windows 10 Basic membership is no longer available so setting the value to 1 or 2 enrolls the device into Advanced membership.
+Criteria: If the value "DisableBlockAtFirstSeen" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75167"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89847r6_rule" severity="medium" weight="10.0"><version>WNDF-AV-000010</version><title>Windows Defender AV must be configured to join Microsoft MAPS.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default) (0x1) Basic membership (0x2) Advanced membership Basic membership will send basic information to Microsoft about software that has been detected including where the software came from the actions that you apply or that are applied automatically and whether the actions were successful. Advanced membership in addition to basic information will send more information to Microsoft about malicious software spyware and potentially unwanted software including the location of the software file names how the software operates and how it has impacted your computer. If you enable this setting you will join Microsoft MAPS with the membership specified. If you disable or do not configure this setting you will not join Microsoft MAPS. In Windows 10 Basic membership is no longer available so setting the value to 1 or 2 enrolls the device into Advanced membership.
+
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81779r8_fix">This is applicable to unclassified systems, for other systems this is NA.
+
+Set the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; MAPS &gt;&gt; "Join Microsoft MAPS" to "Enabled" and select "Advanced MAPS" from the drop down box.
 
-Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this feature will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting disables Microsoft Active Protection Service membership and reporting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81779r5_fix">This is applicable to unclassified systems, for other systems this is Not Applicable.
 
-Set the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; MAPS  "Join Microsoft MAPS" to "Enabled" and select "Advanced MAPS" from the drop down box.  
-</fixtext><fix id="F-81779r5_fix" /><check system="C-74959r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is Not Applicable.
+</fixtext><fix id="F-81779r8_fix" /><check system="C-74959r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA.
 
-Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; MAPS "Join Microsoft MAPS" is set to "Enabled" and "Advanced MAPS" is selected.
+Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; MAPS &gt;&gt; "Join Microsoft MAPS" is set to "Enabled" and "Advanced MAPS" selected from the drop down box.
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Spynet
 
-Criteria: If the value "SpynetReporting" is “REG_DWORD = 2”, this is not a finding.
+Criteria: If the value "SpynetReporting" is REG_DWORD = 2, this is not a finding.
 </check-content></check></Rule></Group><Group id="V-75207"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89887r3_rule" severity="medium" weight="10.0"><version>WNDF-AV-000011</version><title>Windows Defender AV must be configured to only send safe samples for MAPS telemetry.</title><description>&lt;VulnDiscussion&gt;This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: (0x0) Always prompt  (0x1) Send safe samples automatically  (0x2) Never send  (0x3) Send all samples automatically.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81859r4_fix">This is applicable to unclassified systems, for other systems this is NA.
 
 Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; MAPS -&gt; "Send file samples when further analysis is required" to "Enabled" and select "Send safe samples" from the drop down box.</fixtext><fix id="F-81859r4_fix" /><check system="C-74999r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA.
 
 Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; MAPS -&gt; "Send file samples when further analysis is required" is set to "Enabled" and "Send safe samples" selected from the drop down box.
-     
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Spynet
 
 Criteria: If the value "SubmitSamplesConsent" is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-75209"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89889r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000012</version><title>Windows Defender AV must be configured for protocol recognition for network protection.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure protocol recognition for network protection against exploits of known vulnerabilities. If you enable or do not configure this setting protocol recognition will be enabled. If you disable this setting protocol recognition will be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81819r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Network Inspection System -&gt; "Turn on protocol recognition" to "Enabled" or "Not Configured".</fixtext><fix id="F-81819r2_fix" /><check system="C-75001r10_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Network Inspection System -&gt; "Turn on protocol recognition" is set to "Enabled" or "Not Configured".
- 
+
 Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\NIS
 
@@ -105,8 +108,8 @@ Criteria: If the value "DisableProtocolRecognition" is REG_DWORD = 0, this is no
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75211"><title>SRG-APP-000112</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89891r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000013</version><title>Windows Defender AV must be configured to not allow local override of monitoring for file and program activity.</title><description>&lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001695</ident><fixtext fixref="F-81821r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for monitoring file and program activity on your computer" to "Disabled" or "Not Configured".</fixtext><fix id="F-81821r2_fix" /><check system="C-75003r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for monitoring file and program activity on your computer" is set to "Disabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "LocalSettingOverrideDisableOnAccessProtection" is REG_DWORD = 0, this is not a finding.
@@ -114,8 +117,8 @@ Criteria: If the value "LocalSettingOverrideDisableOnAccessProtection" is REG_DW
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75213"><title>SRG-APP-000112</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89893r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000014</version><title>Windows Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity.</title><description>&lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001695</ident><fixtext fixref="F-81823r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for monitoring for incoming and outgoing file activity" to "Disabled" or "Not Configured".</fixtext><fix id="F-81823r2_fix" /><check system="C-75005r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for monitoring for incoming and outgoing file activity" is set to "Disabled" or "Not Configure".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "LocalSettingOverrideRealtimeScanDirection" is REG_DWORD = 0, this is not a finding.
@@ -123,8 +126,8 @@ Criteria: If the value "LocalSettingOverrideRealtimeScanDirection" is REG_DWORD
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75215"><title>SRG-APP-000209</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89895r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000015</version><title>Windows Defender AV must be configured to not allow override of scanning for downloaded files and attachments.</title><description>&lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001169</ident><fixtext fixref="F-81825r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for scanning all downloaded files and attachments" to "Disabled" or "Not Configured".</fixtext><fix id="F-81825r2_fix" /><check system="C-75007r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for scanning all downloaded files and attachments" is set to "Disabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "LocalSettingOverrideDisableIOAVProtection" is REG_DWORD = 0, this is not a finding.
@@ -132,8 +135,8 @@ Criteria: If the value "LocalSettingOverrideDisableIOAVProtection" is REG_DWORD
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75217"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89897r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000016</version><title>Windows Defender AV must be configured to not allow override of behavior monitoring.</title><description>&lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81827r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for turn on behavior monitoring" to "Disabled" or "Not Configured".</fixtext><fix id="F-81827r2_fix" /><check system="C-75009r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override for turn on behavior monitoring" is set to "Disabled" or "Not Configure".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "LocalSettingOverrideDisableBehaviorMonitoring" is REG_DWORD = 0, this is not a finding.
@@ -141,8 +144,8 @@ Criteria: If the value "LocalSettingOverrideDisableBehaviorMonitoring" is REG_DW
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75219"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89899r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000017</version><title>Windows Defender AV Group Policy settings must take priority over the local preference settings.</title><description>&lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81829r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override to turn on real-time protection" to "Disabled" or "Not Configured".</fixtext><fix id="F-81829r2_fix" /><check system="C-75011r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure local setting override to turn on real-time protection" is set to "Disabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "LocalSettingOverrideDisableRealtimeMonitoring" is REG_DWORD = 0, this is not a finding.
@@ -150,8 +153,8 @@ Criteria: If the value "LocalSettingOverrideDisableRealtimeMonitoring" is REG_DW
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75221"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89901r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000018</version><title>Windows Defender AV must monitor for incoming and outgoing files.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure monitoring for incoming and outgoing files without having to turn off monitoring entirely. It is recommended for use on servers where there is a lot of incoming and outgoing file activity but for performance reasons need to have scanning disabled for a particular scan direction. The appropriate configuration should be evaluated based on the server role. Note that this configuration is only honored for NTFS volumes. For any other file system type full monitoring of file and program activity will be present on those volumes. The options for this setting are mutually exclusive: 0 = Scan incoming and outgoing files (default) 1 = Scan incoming files only 2 = Scan outgoing files only  Any other value or if the value does not exist resolves to the default (0). If you enable this setting the specified type of monitoring will be enabled. If you disable or do not configure this setting monitoring for incoming and outgoing files will be enabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81831r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure monitoring for incoming and outgoing file and program activity" to "Disabled" or "Not Configured".</fixtext><fix id="F-81831r2_fix" /><check system="C-75013r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Configure monitoring for incoming and outgoing file and program activity" is set to "Disabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "RealtimeScanDirection" is REG_DWORD = 0, this is not a finding.
@@ -159,8 +162,8 @@ Criteria: If the value "RealtimeScanDirection" is REG_DWORD = 0, this is not a f
 If the value does not exist, this is not a finding.
 
 If the value is 1 or 2, this is a finding.</check-content></check></Rule></Group><Group id="V-75223"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89903r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000019</version><title>Windows Defender AV must be configured to monitor for file and program activity.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure monitoring for file and program activity. If you enable or do not configure this setting monitoring for file and program activity will be enabled. If you disable this setting monitoring for file and program activity will be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81833r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Monitor file and program activity on your computer" to "Enabled" or "Not Configured".</fixtext><fix id="F-81833r2_fix" /><check system="C-75015r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Monitor file and program activity on your computer to be scanned" is set to "Enabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "DisableOnAccessProtection" is REG_DWORD = 0, this is not a finding.
@@ -168,8 +171,8 @@ Criteria: If the value "DisableOnAccessProtection" is REG_DWORD = 0, this is not
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75225"><title>SRG-APP-000209</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89905r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000020</version><title>Windows Defender AV must be configured to scan all downloaded files and attachments.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure scanning for all downloaded files and attachments. If you enable or do not configure this setting scanning for all downloaded files and attachments will be enabled. If you disable this setting scanning for all downloaded files and attachments will be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001169</ident><fixtext fixref="F-81835r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Scan all downloaded files and attachments" to "Enabled" or "Not Configured".</fixtext><fix id="F-81835r2_fix" /><check system="C-75017r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Scan all downloaded files and attachments" is set to "Enabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "DisableIOAVProtection" is REG_DWORD = 0, this is not a finding.
@@ -177,8 +180,8 @@ Criteria: If the value "DisableIOAVProtection" is REG_DWORD = 0, this is not a f
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75227"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89907r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000021</version><title>Windows Defender AV must be configured to always enable real-time protection.</title><description>&lt;VulnDiscussion&gt;This policy setting turns off real-time protection prompts for known malware detection. Windows Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. If you enable this policy setting Windows Defender Antivirus will not prompt users to take actions on malware detections. If you disable or do not configure this policy setting Windows Defender Antivirus will prompt users to take actions on malware detections.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81837r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Turn off real-time protection" to "Disabled" or "Not Configured".</fixtext><fix id="F-81837r2_fix" /><check system="C-75019r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Turn off real-time protection" is set to "Disabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "DisableRealtimeMonitoring" is REG_DWORD = 0, this is not a finding.
@@ -186,8 +189,8 @@ Criteria: If the value "DisableRealtimeMonitoring" is REG_DWORD = 0, this is not
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75229"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89909r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000022</version><title>Windows Defender AV must be configured to enable behavior monitoring.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure behavior monitoring. If you enable or do not configure this setting behavior monitoring will be enabled. If you disable this setting behavior monitoring will be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81839r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Turn on behavior monitoring" to "Enabled " or "Not Configured".</fixtext><fix id="F-81839r2_fix" /><check system="C-75021r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Turn on behavior monitoring" is set to "Enabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "DisableBehaviorMonitoring" is REG_DWORD = 0, this is not a finding.
@@ -195,8 +198,8 @@ Criteria: If the value "DisableBehaviorMonitoring" is REG_DWORD = 0, this is not
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75231"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89911r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000023</version><title>Windows Defender AV must be configured to process scanning when real-time protection is enabled.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. If you enable or do not configure this setting  a process scan will be initiated when real-time protection is turned on. If you disable this setting a process scan will not be initiated when real-time protection is turned on.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81841r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; Turn on process scanning whenever real-time protection is enabled to "Enabled" or "Not Configured".</fixtext><fix id="F-81841r2_fix" /><check system="C-75023r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Real-time Protection -&gt; "Turn on process scanning whenever real-time protection is enabled" is set to "Enabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
 
 Criteria: If the value "DisableScanOnRealtimeEnable" is REG_DWORD = 0, this is not a finding.
@@ -204,8 +207,8 @@ Criteria: If the value "DisableScanOnRealtimeEnable" is REG_DWORD = 0, this is n
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75233"><title>SRG-APP-000278</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89913r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000024</version><title>Windows Defender AV must be configured to scan archive files.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. If you enable or do not configure this setting archive files will be scanned. If you disable this setting archive files will not be scanned.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81843r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Scan archive files" to "Enabled " or "Not Configured".</fixtext><fix id="F-81843r2_fix" /><check system="C-75025r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Scan archive files" is set to "Enabled" or "Not Configured".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Scan
 
 Criteria: If the value "DisableArchiveScanning" is REG_DWORD = 0, this is not a finding.
@@ -213,27 +216,27 @@ Criteria: If the value "DisableArchiveScanning" is REG_DWORD = 0, this is not a
 If the value does not exist, this is not a finding.
 
 If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75235"><title>SRG-APP-000073</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89915r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000025</version><title>Windows Defender AV must be configured to scan removable drives.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives such as USB flash drives when running a full scan. If you enable this setting removable drives will be scanned during any type of scan. If you disable or do not configure this setting removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000870</ident><fixtext fixref="F-81845r3_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Scan removable drives" to "Enabled".</fixtext><fix id="F-81845r3_fix" /><check system="C-75027r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Scan removable drives" is set to "Enabled".
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Scan
 
 Criteria: If the value "DisableRemovableDriveScanning" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75237"><title>SRG-APP-000277</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89917r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000026</version><title>Windows Defender AV must be configured to perform a weekly scheduled scan.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day  (0x1) Sunday  (0x2) Monday  (0x3) Tuesday  (0x4) Wednesday  (0x5) Thursday  (0x6) Friday  (0x7) Saturday  (0x8) Never (default)  If you enable this setting a scheduled scan will run at the frequency specified. If you disable or do not configure this setting a scheduled scan will run at a default frequency.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001241</ident><fixtext fixref="F-81847r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Specify the day of the week to run a scheduled scan" to "Enabled " and select anything other than "Never" in the drop down box.</fixtext><fix id="F-81847r2_fix" /><check system="C-75029r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Specify the day of the week to run a scheduled scan" is set to "Enabled" and anything other than "Never" selected in the drop down box.
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Scan
 
 Criteria: If the value "ScheduleDay" is REG_DWORD = 0x8, this is a finding.
 
 Values of 0x0 through 0x7 are acceptable and not a finding.</check-content></check></Rule></Group><Group id="V-75239"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89919r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000027</version><title>Windows Defender AV must be configured to turn on e-mail scanning.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled the engine will parse the mailbox and mail files according to their specific format in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported for example: pst (Outlook) dbx mbx mime (Outlook Express) binhex (Mac). If you enable this setting e-mail scanning will be enabled. If you disable or do not configure this setting e-mail scanning will be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81849r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Turn on e-mail scanning" to "Enabled".</fixtext><fix id="F-81849r2_fix" /><check system="C-75031r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Scan -&gt; "Turn on e-mail scanning" is set to "Enabled".
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Scan
 
 Criteria: If the value "DisableEmailScanning" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75241"><title>SRG-APP-000276</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89921r2_rule" severity="high" weight="10.0"><version>WNDF-AV-000028</version><title>Windows Defender AV spyware definition age must not exceed 7 days.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to define the number of days that must pass before spyware definitions are considered out of date. If definitions are determined to be out of date this state may trigger several additional actions including falling back to an alternative update source or displaying a warning icon in the user interface. By default this value is set to 14 days. If you enable this setting spyware definitions will be considered out of date after the number of days specified have passed without an update. If you disable or do not configure this setting spyware definitions will be considered out of date after the default number of days have passed without an update.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001240</ident><fixtext fixref="F-81851r2_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Signature Updates -&gt; "Define the number of days before spyware definitions are considered out of date" to "Enabled" and select "7" or less in the drop down box.
 
 Do not select a value of 0. This disables the option.</fixtext><fix id="F-81851r2_fix" /><check system="C-75033r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Signature Updates -&gt; "Define the number of days before spyware definitions are considered out of date" is set to "Enabled" and "7"or less selected in the drop down box (excluding "0", which is unacceptable).
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates
 
 Criteria: If the value "ASSignatureDue" is REG_DWORD = 7, this is not a finding.
@@ -248,7 +251,7 @@ Do not select a value of 0.
 
 This disables the option.</fixtext><fix id="F-81853r2_fix" /><check system="C-75035r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Signature Updates -&gt; "Define the number of days before virus definitions are considered out of date" is set to "Enabled" and "7" or less selected in the drop down box (excluding "0", which is unacceptable).
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates
 
 Criteria: If the value "AVSignatureDue" is REG_DWORD = 7, this is not a finding.
@@ -258,13 +261,13 @@ A value of 1 - 6 is also acceptable and not a finding.
 A value of 0 is a finding.
 
 A value higher than 7 is a finding.</check-content></check></Rule></Group><Group id="V-75245"><title>SRG-APP-000261</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89925r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000030</version><title>Windows Defender AV must be configured to check for definition updates daily.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to specify the day of the week on which to check for definition updates. The check can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (default)  (0x1) Sunday   (0x2) Monday  (0x3) Tuesday  (0x4) Wednesday  (0x5) Thursday  (0x6) Friday  (0x7) Saturday  (0x8) Never  If you enable this setting the check for definition updates will occur at the frequency specified. If you disable or do not configure this setting the check for definition updates will occur at a default frequency.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001308</ident><fixtext fixref="F-81855r3_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Signature Updates -&gt; "Specify the day of the week to check for definition updates" to "Enabled" and select "Every Day" in the drop down box.</fixtext><fix id="F-81855r3_fix" /><check system="C-75037r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Signature Updates -&gt; "Specify the day of the week to check for definition updates" is set to "Enabled" and "Every Day" is selected in the drop down box.
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Signature Update
 
 Criteria: If the value "ScheduleDay" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75247"><title>SRG-APP-000207</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-89927r3_rule" severity="medium" weight="10.0"><version>WNDF-AV-000031</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level Severe.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are:  1 = Low  2 =  Medium  4 = High  5 = Severe  Valid remediation action values are: 2 = Quarantine  3 = Remove  6 = Ignore&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-81857r3_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" to "Enabled".  Select the “Show…” option box and enter "5” in the ‘Value name’ field and enter “2" in the ‘Value’ field. </fixtext><fix id="F-81857r3_fix" /><check system="C-75039r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled".  Click the “Show…” box option and verify the ‘Value name’ field contains a value of “5” and the ‘Value’ field  contains a “2".  A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value.
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
 
 Criteria: If the value "5" is REG_SZ = 2 (or 3), this is not a finding.
@@ -277,7 +280,7 @@ Verify the policy value for Computer Configuration -&gt; Administrative Template
 Value name: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
 Value:  1
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
 
 Criteria: If the value “BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77967"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92663r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000033</version><title>Windows Defender AV must be configured block Office applications from creating child processes.</title><description>&lt;VulnDiscussion&gt;Office apps, such as Word or Excel, will not be allowed to create child processes.
@@ -288,7 +291,7 @@ Verify the policy value for Computer Configuration -&gt; Administrative Template
 Value name: D4F940AB-401B-4EFC-AADC-AD5F3C50688A
 Value:  1
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
 
 Criteria: If the value “D4F940AB-401B-4EFC-AADC-AD5F3C50688A” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77969"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92665r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000034</version><title>Windows Defender AV must be configured block Office applications from creating executable content.</title><description>&lt;VulnDiscussion&gt;This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique.
@@ -297,8 +300,8 @@ Extensions will be blocked from being used by Office apps. Typically these exten
 Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Windows Defender Exploit Guard -&gt; Attack Surface Reduction -&gt; "Configure Attack Surface Reduction rules" is set to "Enabled”.  Click ‘Show...’.  Verify the rule ID in the Value name column and the desired state in the Value column is set as follows:
 Value name: 3B576869-A4EC-4529-8536-B80A7769E899
 Value:  1
- 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
 
 Criteria: If the value “3B576869-A4EC-4529-8536-B80A7769E899” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77971"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92667r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000035</version><title>Windows Defender AV must be configured to block Office applications from injecting into other processes.</title><description>&lt;VulnDiscussion&gt;Office apps, such as Word, Excel, or PowerPoint, will not be able to inject code into other processes.  This is typically used by malware to run malicious code in an attempt to hide the activity from antivirus scanning engines.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84683r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Windows Defender Exploit Guard -&gt; Attack Surface Reduction -&gt; "Configure Attack Surface Reduction rules" to "Enabled”.   Click ‘Show...’.  Set the Value name to “75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84” and the Value to “1”.  </fixtext><fix id="F-84683r1_fix" /><check system="C-77581r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions.
@@ -307,17 +310,17 @@ Verify the policy value for Computer Configuration -&gt; Administrative Template
 Value name: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84
 Value:  1
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
 
 Criteria: If the value “75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77973"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92669r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000036</version><title>Windows Defender AV must be configured to impede JavaScript and VBScript to launch executables.</title><description>&lt;VulnDiscussion&gt;JavaScript and VBScript scripts can be used by malware to launch other malicious apps.
 This rule prevents these scripts from being allowed to launch apps, thus preventing malicious use of the scripts to spread malware and infect machines.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84685r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Windows Defender Exploit Guard -&gt; Attack Surface Reduction -&gt; "Configure Attack Surface Reduction rules" to "Enabled”.   Click ‘Show...’.  Set the Value name to “D3E037E1-3EB8-44C8-A917-57927947596D” and the Value to “1”.  </fixtext><fix id="F-84685r1_fix" /><check system="C-77583r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions.
 
 Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Windows Defender Exploit Guard -&gt; Attack Surface Reduction -&gt; "Configure Attack Surface Reduction rules" is set to "Enabled”.  Click ‘Show...’.  Verify the rule ID in the Value name column and the desired state in the Value column is set as follows:
-Value name: D3E037E1-3EB8-44C8-A917-57927947596D 
+Value name: D3E037E1-3EB8-44C8-A917-57927947596D
 Value:  1
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
 
 Criteria: If the value “D3E037E1-3EB8-44C8-A917-57927947596D” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77975"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92671r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000037</version><title>Windows Defender AV must be configured to block execution of potentially obfuscated scripts.</title><description>&lt;VulnDiscussion&gt;Malware and other threats can attempt to obfuscate or hide their malicious code in some script files.  This rule prevents scripts that appear to be obfuscated from running.
@@ -328,7 +331,7 @@ Verify the policy value for Computer Configuration -&gt; Administrative Template
 Value name: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
 Value:  1
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
 
 Criteria: If the value “5BEB7EFE-FD9A-4556-801D-275E5FFC04CC” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77977"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92673r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000038</version><title>Windows Defender AV must be configured to block Win32 imports from macro code in Office.</title><description>&lt;VulnDiscussion&gt;This rule blocks potentially malicious behavior by not allowing macro code to execute routines in the Win 32 dynamic link library (DLL).  &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84689r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Windows Defender Exploit Guard -&gt; Attack Surface Reduction -&gt; "Configure Attack Surface Reduction rules" to "Enabled”.   Click ‘Show...’.  Set the Value name to “92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B” and the Value to “1”.  </fixtext><fix id="F-84689r1_fix" /><check system="C-77587r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions.
@@ -337,29 +340,29 @@ Verify the policy value for Computer Configuration -&gt; Administrative Template
 Value name: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
 Value:  1
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
 
 Criteria: If the value “92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77979"><title>SRG-APP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-92675r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000039</version><title>Windows Defender AV must be configured to prevent user and apps from accessing dangerous websites.</title><description>&lt;VulnDiscussion&gt;Enable Windows Defender Exploit Guard network protection to prevent employees from using any application to access dangerous domains that may host phishing scams exploit-hosting sites and other malicious content on the Internet.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84691r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Windows Defender Exploit Guard -&gt; Network Protection -&gt; "Prevent users and apps from accessing dangerous websites" to "Enabled” and select “Block" in the drop down box.</fixtext><fix id="F-84691r1_fix" /><check system="C-77589r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions.
 
  Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Windows Defender Exploit Guard -&gt; Network Protection -&gt; "Prevent users and apps from accessing dangerous websites" is set to "Enabled” and “Block" selected in the drop down box.
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
 
 Criteria: If the value "EnableNetworkProtection" is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-79965"><title>SRG-APP-000207</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-94669r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000040</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level High.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are:  1 = Low  2 =  Medium  4 = High  5 = Severe  Valid remediation action values are: 2 = Quarantine  3 = Remove  6 = Ignore&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-86769r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" to "Enabled".  Select the “Show…” option box and enter "4” in the ‘Value name’ field and enter “2" in the ‘Value’ field. </fixtext><fix id="F-86769r1_fix" /><check system="C-79633r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled".  Click the “Show…” box option and verify the ‘Value name’ field contains a value of “4” and the ‘Value’ field  contains a “2".  A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value.
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
 
 Criteria: If the value "4" is REG_SZ = 2 (or 3), this is not a finding. </check-content></check></Rule></Group><Group id="V-79967"><title>SRG-APP-000207</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-94671r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000041</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level Medium.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are:  1 = Low  2 =  Medium  4 = High  5 = Severe  Valid remediation action values are: 2 = Quarantine  3 = Remove  6 = Ignore&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-86771r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" to "Enabled".  Select the “Show…” option box and enter "2” in the ‘Value name’ field and enter “2" in the ‘Value’ field.</fixtext><fix id="F-86771r1_fix" /><check system="C-79635r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled".  Click the “Show…” box option and verify the ‘Value name’ field contains a value of “2” and the ‘Value’ field  contains a “2".  A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value.
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
 
 Criteria: If the value "2" is REG_SZ = 2 (or 3), this is not a finding.</check-content></check></Rule></Group><Group id="V-79971"><title>SRG-APP-000207</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-94675r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000042</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level Low.</title><description>&lt;VulnDiscussion&gt;This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are:  1 = Low  2 =  Medium  4 = High  5 = Severe  Valid remediation action values are: 2 = Quarantine  3 = Remove  6 = Ignore&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-86775r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" to "Enabled".  Select the “Show…” option box and enter "1” in the ‘Value name’ field and enter “2" in the ‘Value’ field.</fixtext><fix id="F-86775r1_fix" /><check system="C-79637r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Windows Defender Antivirus -&gt; Threats -&gt; "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled".  Click the “Show…” box option and verify the ‘Value name’ field contains a value of “1” and the ‘Value’ field  contains a “2".  A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value.
-  
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+Procedure: Use the Windows Registry Editor to navigate to the following key:
 HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
 
 Criteria: If the value "1" is REG_SZ = 2 (or 3), this is not a finding.</check-content></check></Rule></Group></Benchmark>
diff --git a/StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R6_Manual-xccdf.xml b/source/StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R6_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R6_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R6_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R7_Manual-xccdf.xml b/source/StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R7_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R7_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Firewall/U_Windows_Firewall_STIG_V1R7_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R10_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R10_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_MS_STIG_V1R9_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R10_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R10_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R10_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R10_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R9_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R9_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R9_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V1R9_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R2_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_DC_STIG_V1R3_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.log
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.log
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.log
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R3_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R2_Manual-xccdf.xml
diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R3_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R3_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R3_Manual-xccdf.xml
rename to source/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_STIG_V1R3_Manual-xccdf.xml
diff --git a/StigData/Archive/browser/U_Mozilla_FireFox_V4R27_Manual-xccdf.xml b/source/StigData/Archive/browser/U_Mozilla_FireFox_V4R27_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/browser/U_Mozilla_FireFox_V4R27_Manual-xccdf.xml
rename to source/StigData/Archive/browser/U_Mozilla_FireFox_V4R27_Manual-xccdf.xml
diff --git a/StigData/Archive/browser/U_Mozilla_FireFox_V4R28_Manual-xccdf.xml b/source/StigData/Archive/browser/U_Mozilla_FireFox_V4R28_Manual-xccdf.xml
similarity index 100%
rename from StigData/Archive/browser/U_Mozilla_FireFox_V4R28_Manual-xccdf.xml
rename to source/StigData/Archive/browser/U_Mozilla_FireFox_V4R28_Manual-xccdf.xml
diff --git a/StigData/Archive/formatting.md b/source/StigData/Archive/formatting.md
similarity index 100%
rename from StigData/Archive/formatting.md
rename to source/StigData/Archive/formatting.md
diff --git a/StigData/Processed/Adobe-AcrobatReader-1.6.org.default.xml b/source/StigData/Processed/Adobe-AcrobatReader-1.6.org.default.xml
similarity index 100%
rename from StigData/Processed/Adobe-AcrobatReader-1.6.org.default.xml
rename to source/StigData/Processed/Adobe-AcrobatReader-1.6.org.default.xml
diff --git a/StigData/Processed/Adobe-AcrobatReader-1.6.xml b/source/StigData/Processed/Adobe-AcrobatReader-1.6.xml
similarity index 100%
rename from StigData/Processed/Adobe-AcrobatReader-1.6.xml
rename to source/StigData/Processed/Adobe-AcrobatReader-1.6.xml
diff --git a/StigData/Processed/DotNetFramework-4-1.8.org.default.xml b/source/StigData/Processed/DotNetFramework-4-1.8.org.default.xml
similarity index 100%
rename from StigData/Processed/DotNetFramework-4-1.8.org.default.xml
rename to source/StigData/Processed/DotNetFramework-4-1.8.org.default.xml
diff --git a/StigData/Processed/DotNetFramework-4-1.8.xml b/source/StigData/Processed/DotNetFramework-4-1.8.xml
similarity index 100%
rename from StigData/Processed/DotNetFramework-4-1.8.xml
rename to source/StigData/Processed/DotNetFramework-4-1.8.xml
diff --git a/StigData/Processed/DotNetFramework-4-1.9.org.default.xml b/source/StigData/Processed/DotNetFramework-4-1.9.org.default.xml
similarity index 100%
rename from StigData/Processed/DotNetFramework-4-1.9.org.default.xml
rename to source/StigData/Processed/DotNetFramework-4-1.9.org.default.xml
diff --git a/StigData/Processed/DotNetFramework-4-1.9.xml b/source/StigData/Processed/DotNetFramework-4-1.9.xml
similarity index 100%
rename from StigData/Processed/DotNetFramework-4-1.9.xml
rename to source/StigData/Processed/DotNetFramework-4-1.9.xml
diff --git a/StigData/Processed/FireFox-All-4.27.org.default.xml b/source/StigData/Processed/FireFox-All-4.27.org.default.xml
similarity index 100%
rename from StigData/Processed/FireFox-All-4.27.org.default.xml
rename to source/StigData/Processed/FireFox-All-4.27.org.default.xml
diff --git a/StigData/Processed/FireFox-All-4.27.xml b/source/StigData/Processed/FireFox-All-4.27.xml
similarity index 100%
rename from StigData/Processed/FireFox-All-4.27.xml
rename to source/StigData/Processed/FireFox-All-4.27.xml
diff --git a/StigData/Processed/FireFox-All-4.28.org.default.xml b/source/StigData/Processed/FireFox-All-4.28.org.default.xml
similarity index 100%
rename from StigData/Processed/FireFox-All-4.28.org.default.xml
rename to source/StigData/Processed/FireFox-All-4.28.org.default.xml
diff --git a/StigData/Processed/FireFox-All-4.28.xml b/source/StigData/Processed/FireFox-All-4.28.xml
similarity index 100%
rename from StigData/Processed/FireFox-All-4.28.xml
rename to source/StigData/Processed/FireFox-All-4.28.xml
diff --git a/source/StigData/Processed/IISServer-10.0-1.1.org.default.xml b/source/StigData/Processed/IISServer-10.0-1.1.org.default.xml
new file mode 100644
index 000000000..b42a19d87
--- /dev/null
+++ b/source/StigData/Processed/IISServer-10.0-1.1.org.default.xml
@@ -0,0 +1,11 @@
+<!--
+    The organizational settings file is used to define the local organizations
+    preferred setting within an allowed range of the STIG.
+
+    Each setting in this file is linked by STIG ID and the valid range is in an
+    associated comment.
+-->
+<OrganizationalSettings fullversion="1.1">
+  <!-- Ensure ''V-100145.b'' -le '00:20:00'-->
+  <OrganizationalSetting id="V-100145.b" Value="00:20:00" />
+</OrganizationalSettings>
diff --git a/source/StigData/Processed/IISServer-10.0-1.1.xml b/source/StigData/Processed/IISServer-10.0-1.1.xml
new file mode 100644
index 000000000..2274b0c55
--- /dev/null
+++ b/source/StigData/Processed/IISServer-10.0-1.1.xml
@@ -0,0 +1,1484 @@
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IIS_10-0_Server_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_IIS_10-0_Server_V1R1_Manual-xccdf.xml" releaseinfo="Release: 1 Benchmark Date: 20 Mar 2020" title="Microsoft IIS 10.0 Server Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.1" created="5/29/2020">
+  <DocumentRule dscresourcemodule="None">
+    <Rule id="V-100103" severity="medium" conversionstatus="pass" title="SRG-APP-000015-WSR-000014" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.
+
+An alternative to remote administration of the web server is to perform web server administration locally at the console. Local administration at the console implies physical access to the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If web administration is performed at the console, this check is NA.
+
+If web administration is performed remotely the following checks will apply:
+
+If administration of the server is performed remotely, it will only be performed securely by system administrators.
+
+If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO.
+
+Remote administration must be in compliance with any requirements contained within the Windows Server STIGs, and any applicable Network STIGs.
+
+Remote administration of any kind will be restricted to documented and authorized personnel.
+
+All users performing remote administration must be authenticated.
+
+All remote sessions will be encrypted and utilize FIPS 140-2-approved protocols.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater.
+
+Review with site management how remote administration is configured on the website, if applicable.
+
+If remote management meets the criteria listed above, this is not a finding.
+
+If remote management is utilized and does not meet the criteria listed above, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100119" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000015" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;User management and authentication can be an essential part of any application hosted by the web server. Along with authenticating users, the user management function must perform several other tasks enterprise-wide, such as password complexity, locking users after a configurable number of failed logons, and management of temporary and emergency accounts.
+
+The web server contains a minimal user management function, but the web server user management function does not offer enterprise-wide user management, and user management is not the primary function of the web server. User management for the hosted applications should be done through a facility built for enterprise-wide user management, such as LDAP and Active Directory.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Interview the System Administrator about the role of the IIS 10.0 web server.
+
+If the IIS 10.0 web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server.
+
+If the IIS 10.0 web server is not hosting an application, this is Not Applicable.
+
+If the IIS web server is performing user management for hosted applications, this is a finding.
+
+If the IIS 10.0 web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100121" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000075" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to run on a production DoD system.
+
+The web server must provide the capability to disable, uninstall, or deactivate functionality and services deemed non-essential to the web server mission or that adversely impact server performance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Click “Start”.
+
+Open Control Panel.
+
+Click “Programs”.
+
+Click “Programs and Features”.
+
+Review the installed programs. If any programs are installed other than those required for the IIS 10.0 web services, this is a finding.
+
+Note: If additional software is needed, supporting documentation must be signed by the ISSO.</RawString>
+    </Rule>
+    <Rule id="V-100139" severity="high" conversionstatus="pass" title="SRG-APP-000211-WSR-000030" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Obtain a list of the user accounts with access to the system, including all local and domain accounts.
+
+Review the privileges to the web server for each account.
+
+Verify with the system administrator or the ISSO that all privileged accounts are mission essential and documented.
+
+Verify with the system administrator or the ISSO that all non-administrator access to shell scripts and operating system functions are mission essential and documented.
+
+If undocumented privileged accounts are found, this is a finding.
+
+If undocumented non-administrator access to shell scripts and operating system functions are found, this is a finding.
+
+If this IIS 10 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</RawString>
+    </Rule>
+    <Rule id="V-100147" severity="medium" conversionstatus="pass" title="SRG-APP-000225-WSR-000074" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Making certain that the web server has not been updated by an unauthorized user is always a concern. Adding patches, functions, and modules that are untested and not part of the baseline opens the possibility for security risks. The web server must offer, and not hinder, a method that allows for the quick and easy reinstallation of a verified and patched baseline to guarantee the production web server is up-to-date and has not been modified to add functionality or expose security risks.
+
+When the web server does not offer a method to roll back to a clean baseline, external methods, such as a baseline snapshot or virtualizing the web server, can be used.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Interview the System Administrator for the IIS 10.0 web server.
+
+Ask for documentation on the disaster recovery methods tested and planned for the IIS 10.0 web server in the event of the necessity for rollback.
+
+If documentation for a disaster recovery has not been established, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100153" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000142" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The indexing service can be used to facilitate a search function for websites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\.
+
+If this key exists, then indexing is enabled.
+
+If the key does not exist, this check is Not Applicable.
+
+Review the Catalog keys to determine if directories other than web document directories are being indexed.
+
+If so, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100157" severity="high" conversionstatus="pass" title="SRG-APP-000315-WSR-000003" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If web administration is performed at the console, this check is Not Applicable.
+
+If web administration is performed remotely the following checks will apply.
+
+If administration of the server is performed remotely, it will only be performed securely by system administrators.
+
+If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO.
+
+Remote administration must be in compliance with any requirements contained within the Windows Server STIGs, and any applicable network STIGs.
+
+Remote administration of any kind will be restricted to documented and authorized personnel.
+
+All users performing remote administration must be authenticated.
+
+All remote sessions will be encrypted and utilize FIPS 140-2-approved protocols.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater.
+
+Review with site management how remote administration, if applicable, is configured on the website.
+
+If remote management meets the criteria listed above, this is not a finding.
+
+If remote management is utilized and does not meet the criteria listed above, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100161" severity="medium" conversionstatus="pass" title="SRG-APP-000316-WSR-000170" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.
+
+The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.
+
+The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Interview the System Administrator and Web Manager.
+
+Ask for documentation for the IIS 10.0 web server administration.
+
+Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 10.0 web server IIS Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS Manager.
+
+In the "Actions" pane, under "Manage Server", click "Stop".
+
+If the web server is not capable or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100165" severity="medium" conversionstatus="pass" title="SRG-APP-000357-WSR-000150" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To ensure the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity.
+
+The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "IIS" double-click the "Logging" icon.
+
+In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.
+
+Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.
+
+Under "Log File Rollover", verify "Do not create new log files" is not selected.
+
+Verify a schedule is configured to rollover log files on a regular basis.
+
+Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device.
+
+If the designated logging path device is not of sufficient space to maintain all log files, and there is not a schedule to rollover files on a regular basis, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100167" severity="medium" conversionstatus="pass" title="SRG-APP-000380-WSR-000072" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A web server can be modified through parameter modification, patch installation, upgrades to the web server or modules, and security parameter changes. With each of these changes, there is the potential for an adverse effect such as a DoS, web server instability, or hosted application instability.
+
+To limit changes to the web server and limit exposure to any adverse effects from the changes, files such as the web server application files, libraries, and configuration files must have permissions and ownership set properly to only allow privileged users access.
+
+The key web service administrative and configuration tools must only be accessible by the web server staff. All users granted this authority will be documented and approved by the ISSO. Access to the IIS Manager will be limited to authorized users and administrators.
+
+Satisfies: SRG-APP-000380-WSR-000072, SRG-APP-000435-WSR-000147, SRG-APP-000033-WSR-000169&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Right-click "InetMgr.exe", then click "Properties" from the "Context" menu.
+
+Select the "Security" tab.
+
+Review the groups and user names.
+
+The following accounts may have Full control privileges:
+
+TrustedInstaller
+Web Managers
+Web Manager designees
+CREATOR OWNER: Full Control, Subfolders and files only
+
+The following accounts may have read and execute, or read permissions:
+
+Non Web Manager Administrators
+ALL APPLICATION PACKAGES (built-in security group)
+ALL RESTRICTED APPLICATION PACKAGES (built-in security group)
+SYSTEM
+Users
+
+Specific users may be granted read and execute and read permissions.
+
+Compare the local documentation authorizing specific users, against the users observed when reviewing the groups and users.
+
+If any other access is observed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100169" severity="medium" conversionstatus="pass" title="SRG-APP-000383-WSR-000175" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.
+
+The web server must provide the capability to disable or deactivate network-related services deemed non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review programs installed on the OS.
+
+Open Control Panel.
+
+Open Programs and Features.
+
+The following programs may be installed without any additional documentation:
+
+Administration Pack for IIS
+IIS Search Engine Optimization Toolkit
+Microsoft .NET Framework version 3.5 SP1 or greater
+Microsoft Web Platform Installer version 3.x or greater
+Virtual Machine Additions
+
+Review the installed programs, if any programs are installed other than those listed above, this is a finding.
+
+Note: If additional software is needed and has supporting documentation signed by the ISSO, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-100173" severity="medium" conversionstatus="pass" title="SRG-APP-000435-WSR-000148" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A Denial of Service (DoS) can occur when the web server is overwhelmed and can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If the IIS 10.0 web server is not hosting any applications, this is Not Applicable.
+
+If the IIS 10.0 web server is hosting applications, consult with the System Administrator to determine risk analysis performed when the application was written and deployed to the IIS 10.0 web server.
+
+Obtain documentation on the configuration.
+
+Verify, at a minimum, the following tuning settings in the registry.
+
+Access the IIS 10.0 web server registry.
+
+Verify the following keys are present and configured. The required setting depends upon the requirements of the application.
+
+Recommended settings are not provided as these settings must be explicitly configured to show a conscientious tuning has been made.
+
+Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\
+"URIEnableCache"
+"UriMaxUriBytes"
+"UriScavengerPeriod"
+
+If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" and "UriScavengerPeriod", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100179" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2-approved TLS versions must be enabled and non-FIPS-approved SSL versions must be disabled.
+
+NIST SP 800-52 defines the approved TLS versions for government applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review the web server documentation and deployed configuration to determine which version of TLS is being used.
+
+If the TLS version is not TLS 1.2 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.</RawString>
+    </Rule>
+  </DocumentRule>
+  <IisLoggingRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100105" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="xIISLogging">
+      <Description>&lt;VulnDiscussion&gt;Log files are a critical component to the successful management of an IS used within the DoD. By generating log files with useful information, web administrators can leverage them in the event of a disaster, malicious attack, or other site specific needs.
+
+Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety.
+
+Without sufficient information establishing when the log event occurred, investigation into the cause of event is severely hindered. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000097-WSR-000059&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry />
+      <LogFlags>Date,Time,ClientIP,UserName,Method,UriQuery,HttpStatus,Referer</LogFlags>
+      <LogFormat />
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Click the "Logging" icon.
+
+Under Format select "W3C".
+
+Click "Select Fields", verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
+
+If not, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100107" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="xIISLogging">
+      <Description>&lt;VulnDiscussion&gt;Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.
+
+In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry />
+      <LogFlags />
+      <LogFormat />
+      <LogPeriod />
+      <LogTargetW3C>File,ETW</LogTargetW3C>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 server name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.
+
+If the "Both log file and ETW event" radio button is not selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100111" severity="medium" conversionstatus="pass" title="SRG-APP-000099-WSR-000061" dscresource="xIISLogging">
+      <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.
+
+Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Connection</SourceName>
+        </Entry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Warning</SourceName>
+        </Entry>
+      </LogCustomFieldEntry>
+      <LogFlags />
+      <LogFormat>W3C</LogFormat>
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 web server IIS Manager.
+Click the IIS 10.0 web server name.
+Under "IIS", double-click the "Logging" icon.
+Verify the "Format:" under "Log File" is configured to "W3C".
+Select the "Fields" button.
+Under "Custom Fields", verify the following fields have been configured:
+Request Header &gt;&gt; Connection
+Request Header &gt;&gt; Warning
+If any of the above fields are not selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100113" severity="medium" conversionstatus="pass" title="SRG-APP-000100-WSR-000064" dscresource="xIISLogging">
+      <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
+
+Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Authorization</SourceName>
+        </Entry>
+        <Entry>
+          <SourceType>ResponseHeader</SourceType>
+          <SourceName>Content-Type</SourceName>
+        </Entry>
+      </LogCustomFieldEntry>
+      <LogFlags>UserAgent,UserName,Referer</LogFlags>
+      <LogFormat>W3C</LogFormat>
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 web server IIS Manager.
+Click the IIS 10.0 web server name.
+Under "IIS", double-click the "Logging" icon.
+Verify the "Format:" under "Log File" is configured to "W3C".
+Select the "Fields" button.
+Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected.
+Under "Custom Fields", verify the following field has been configured:
+Request Header &gt;&gt; Authorization
+Response Header &gt;&gt; Content-Type
+If any of the above fields are not selected, this is a finding.</RawString>
+    </Rule>
+  </IisLoggingRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-100109" severity="medium" conversionstatus="pass" title="SRG-APP-000098-WSR-000060" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the correct source (e.g., source IP), of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the loggable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.
+
+A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy.
+
+If the IIS 10.0 web server is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.
+
+Follow this procedure for web server and each website:
+
+Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Click the "Logging" icon.
+
+Click on "View log files" under the "Actions" pane.
+
+When the log file is displayed, review source IP information in log entries and verify the entries do not reflect the IP address of the proxy server.
+
+If the website is not behind a load balancer or proxy server, this is Not Applicable.
+
+If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
+
+If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-100115" severity="medium" conversionstatus="pass" title="SRG-APP-000120-WSR-000070" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the System Administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.
+
+Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
+Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Click the "Logging" icon.
+Click "Browse" and navigate to the directory where the log files are stored.
+Right-click the log file name to review.
+Click "Properties".
+Click the "Security" tab.
+Verify log file access is restricted as follows. Otherwise, this is a finding.
+SYSTEM - Full Control
+Administrators - Full Control</RawString>
+    </Rule>
+    <Rule id="V-100117" severity="medium" conversionstatus="pass" title="SRG-APP-000125-WSR-000071" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system, or onto separate media than the system on which the web server is running, helps to ensure the log records will be retained in the event of a catastrophic system failure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The IIS 10.0 web server and website log files should be backed up by the system backup.
+
+To determine if log files are backed up by the system backup, determine the location of the web server log files and each website's log files.
+
+Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 server name.
+
+Click the "Logging" icon.
+
+Under "Log File" &gt;&gt; "Directory" obtain the path of the log file.
+
+Once all locations are known, consult with the System Administrator to review the server's backup procedure and policy.
+
+Verify the paths of all log files are part of the system backup.
+Verify log files are backed up to an unrelated system or onto separate media on which the system the web server is running.
+
+If the paths of all log files are not part of the system backup and/or not backed up to a separate media, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100123" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000076" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that also proxy requests into an otherwise protected network is a common attack, making the attack anonymous.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server.
+
+If, under the IIS installed features, "Application Request Routing Cache" is not present, this is not a finding.
+
+If, under the IIS installed features, "Application Request Routing Cache" is present, double-click the icon to open the feature.
+
+From the right "Actions" pane, under "Proxy", select "Server Proxy Settings...".
+
+In the "Application Request Routing" settings window, verify whether "Enable proxy" is selected.
+
+If “Enable proxy" is selected under the "Application Request Routing" settings, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100125" severity="high" conversionstatus="pass" title="SRG-APP-000141-WSR-000077" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Navigate to the following folders:
+
+inetpub\
+Program Files\Common Files\System\msadc
+Program Files (x86)\Common Files\System\msadc
+
+If the folder or sub-folders contain any executable sample code, example applications, or tutorials which are not explicitly used by a production website, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100127" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000078" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Accounts used for web server features such as documentation, sample code, example applications, tutorials, utilities, and services created when the feature is not installed, become an exploitable threat to a web server.
+
+These accounts become inactive, are not monitored through regular use, and passwords for the accounts are not created or updated. An attacker, through very little effort, can use these accounts to gain access to the web server and begin investigating ways to elevate the account privileges.
+
+The accounts used for web server features not installed must not be created and must be deleted when these features are uninstalled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 web server.
+
+Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”.
+
+In the left pane, expand "Local Users and Groups" and click "Users".
+
+Review the local users listed in the middle pane.
+
+If any local accounts are present and were created by features which have been uninstalled or are not used, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100129" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000080" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Just as running unneeded services and protocols is a danger to the web server at the lower levels of the OSI model, running unneeded utilities and programs is a danger at the application layer of the OSI model. Office suites, development tools, and graphic editors are examples of such troublesome programs.
+
+Individual productivity tools have no legitimate place or use on an enterprise production web server and are prone to security risks. The web server installation process must provide options allowing the installer to choose which utility programs, services, and modules are to be installed or removed. By having a process for installation and removal, the web server is guaranteed to be in a more stable and secure state than if these services and programs were installed and removed manually.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Consult with the System Administrator and review all of the IIS 10.0 and Operating System features installed.
+
+Determine if any features installed are no longer necessary for operation.
+
+If any utility programs, features, or modules are installed which are not necessary for operation, this is a finding.
+
+If any unnecessary Operating System features are installed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100135" severity="medium" conversionstatus="pass" title="SRG-APP-000175-WSR-000095" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid, and therefore; the entire purpose of using a certificate is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Server Certificate" icon.
+
+Double-click each certificate and verify the certificate path is to a DoD root CA.
+
+If the “Issued By” field of the PKI certificate being used by the IIS 10.0 server/site does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100137" severity="medium" conversionstatus="pass" title="SRG-APP-000206-WSR-000128" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Mobile code in hosted applications allows the developer to add functionality and displays to hosted applications that are fluid, as opposed to a static web page. The data presentation becomes more appealing to the user, is easier to analyze, and is less complicated to navigate through the hosted application and data.
+
+Some mobile code technologies in use in today's applications are: Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. The DoD has created policies that define the usage of mobile code on DoD systems. The usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on organizational servers and mobile code downloaded and executed on individual workstations.
+
+Source code for a Java program is often stored in files with either .java or .jpp file extensions. From the .java and .jpp files the Java compiler produces a binary file with an extension of .class. The .java or .jpp file could therefore reveal sensitive information regarding an application's logic and permissions to resources on the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Search the system for files with either .java or .jpp extensions.
+
+If files with .java or .jpp extensions are found, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100141" severity="medium" conversionstatus="pass" title="SRG-APP-000211-WSR-000129" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The separation of user functionality from web server management can be accomplished by moving management functions to a separate IP address or port. To further separate the management functions, separate authentication methods and certificates should be used.
+
+By moving the management functionality, the possibility of accidental discovery of the management functions by non-privileged users during hosted application use is minimized.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review the IIS 10.0 web server configuration with the System Administrator.
+
+Determine if the IIS 10.0 web server hosts any applications.
+
+If the IIS 10.0 web server does not host any applications, this is Not Applicable.
+
+If the IIS 10.0 web server hosts applications, review the application's management functionality and authentication methods with the System Administrator to determine if the management of the application is accomplished with the same functions and authentication methods as the web server management.
+
+If the IIS 10.0 web server management and the application's management functionality is not separated, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100159" severity="medium" conversionstatus="pass" title="SRG-APP-000315-WSR-000004" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform management functions.
+
+A web server can be accessed remotely and must be capable of restricting access from what the DoD defines as non-secure zones. Non-secure zones are defined as any IP, subnet, or region defined as a threat to the organization. The non-secure zones must be defined for public web servers logically located in a DMZ, as well as private web servers with perimeter protection devices. By restricting access from non-secure zones through internal web server access lists, the web server can stop or slow denial of service (DoS) attacks on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: This requirement applies to the Web Management Service. If the Web Management Service is not installed, this is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under "Management", double-click "Management Service".
+
+If "Enable remote connections" is not selected, this is Not Applicable.
+
+If "Enable remote connections" is selected, review the entries under "IP Address Restrictions".
+
+Verify only known, secure IP ranges are configured as "Allow".
+
+If "IP Address Restrictions" are not configured or IP ranges configured to "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100171" severity="medium" conversionstatus="pass" title="SRG-APP-000383-WSR-000175" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The use of IPP on an IIS web server allows client access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable.
+
+Navigate to the following directory:
+
+%windir%\web\printers
+
+If this folder exists, this is a finding.
+
+Determine whether Internet Printing is enabled:
+
+Click “Start”, click “Administrative Tools”, and then click “Server Manager”.
+
+Expand the roles node, right-click “Print Services”, and then select “Remove Roles Services”.
+
+If the Internet Printing option is enabled, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100181" severity="high" conversionstatus="pass" title="SRG-APP-000516-WSR-000079" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community.
+
+The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.
+
+Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 web server.
+
+Access the "Apps" menu. Under "Administrative Tools", select "Computer Management".
+
+In left pane, expand "Local Users and Groups" and click "Users".
+
+Review the local users listed in the middle pane.
+
+If any local accounts are present and used by IIS 10.0, verify with System Administrator that default passwords have been changed.
+
+If passwords have not been changed from the default, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100185" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the ".NET Authorization Rules" icon.
+
+If any user other than "Administrator" is listed, this is a finding.
+
+If .NET is not installed, this is Not Applicable.</RawString>
+    </Rule>
+    <Rule id="V-100187" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000001" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 IIS Manager.
+
+Click the IIS 10.0 server.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
+
+Expand "siteDefaults".
+Expand "limits".
+
+Review the results and verify the value is greater than zero for the "maxconnections" parameter.
+
+If the maxconnections parameter is set to zero, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100189" severity="low" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;HTTP Strict Transport Security (HSTS) ensures browsers always connect to a website over TLS. HSTS exists to remove the need for redirection configurations. HSTS relies on the browser, web server, and a public "Whitelist". If the browser does not support HSTS, it will be ignored.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Open IIS Manager.
+
+In the "Connections" pane, select the server name.
+
+In the "Features View" pane, open "HTTP Response Headers".
+
+Verify an entry exists named "Strict-Transport-Security".
+
+Open "Strict-Transport-Security" and verify the value box contains a value greater than 0.
+
+Click "OK".
+
+If HSTS has not been enabled, this is a finding.
+The recommended max age is 8 minutes (480 seconds) or greater. Any value greater than 0 is not a finding.
+If the version of Windows Server does not natively support HSTS, this is not a finding.</RawString>
+    </Rule>
+  </ManualRule>
+  <MimeTypeRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100131.a" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
+
+A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.exe</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/octet-stream</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under IIS, double-click the "MIME Types" icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.exe</RawString>
+    </Rule>
+    <Rule id="V-100131.b" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
+
+A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.dll</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-msdownload</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under IIS, double-click the "MIME Types" icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.dll</RawString>
+    </Rule>
+    <Rule id="V-100131.c" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
+
+A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.com</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/octet-stream</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under IIS, double-click the "MIME Types" icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.com</RawString>
+    </Rule>
+    <Rule id="V-100131.d" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
+
+A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.bat</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-bat</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under IIS, double-click the "MIME Types" icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.bat</RawString>
+    </Rule>
+    <Rule id="V-100131.e" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
+
+A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.csh</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-csh</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under IIS, double-click the "MIME Types" icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.csh</RawString>
+    </Rule>
+  </MimeTypeRule>
+  <PermissionRule dscresourcemodule="AccessControlDsc">
+    <Rule id="V-100163" severity="medium" conversionstatus="pass" title="SRG-APP-000340-WSR-000029" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>System</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>TrustedInstaller</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>ReadAndExecute,ListDirectory</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Force>True</Force>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Path>%SystemDrive%\inetpub</Path>
+      <RawString>Open Explorer and navigate to the inetpub directory.
+
+Right-click "inetpub" and select "Properties".
+
+Click the "Security" tab.
+
+Verify the permissions for the following users; if the permissions are less restrictive, this is a finding.
+
+System: Full control
+Administrators: Full control
+TrustedInstaller: Full control
+ALL APPLICATION PACKAGES (built-in security group): Read and execute
+ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute
+Users: Read and execute, list folder contents
+CREATOR OWNER: Full Control, Subfolders and files only</RawString>
+    </Rule>
+  </PermissionRule>
+  <RegistryRule dscresourcemodule="PSDscResources">
+    <Rule id="V-100177.a" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>DisabledByDefault</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.b" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>0</ValueData>
+      <ValueName>DisabledByDefault</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.c" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>DisabledByDefault</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.d" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>DisabledByDefault</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.e" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>DisabledByDefault</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.f" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>0</ValueData>
+      <ValueName>Enabled</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.g" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>0</ValueData>
+      <ValueName>Enabled</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.h" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>0</ValueData>
+      <ValueName>Enabled</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+    <Rule id="V-100177.i" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 10.0 Web Server.
+
+Access an administrator command prompt and type "regedit &lt;enter&gt;" to access the server's registry.
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
+
+Verify a REG_DWORD value of "0" for "DisabledByDefault"
+
+Navigate to:
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
+
+HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
+
+Verify a REG_DWORD value of "1" for "DisabledByDefault"
+Verify a REG_DWORD value of "0" for "Enabled"
+
+If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.</RawString>
+      <ValueData>0</ValueData>
+      <ValueName>Enabled</ValueName>
+      <ValueType>DWORD</ValueType>
+    </Rule>
+  </RegistryRule>
+  <WebConfigurationPropertyRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100143" severity="medium" conversionstatus="pass" title="SRG-APP-000223-WSR-000011" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol.
+
+Using URI will embed the session ID as a query string in the Uniform Resource Identifier (URI) request and then the URI is redirected to the originally requested URL. The changed URI request is used for the duration of the session, so no cookie is necessary.
+
+By requiring expired session IDs to be regenerated while using URI, potential attackers have less time to capture a cookie and gain access to the Web server content.
+
+Satisfies: SRG-APP-000223-WSR-000011, SRG-APP-000220-WSR-000201&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>cookieless</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Under "ASP.Net", double-click the "Session State" icon.
+Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.
+If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding.
+
+Alternative method:
+
+Click the site name.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+Verify the "cookieless" is set to "UseCookies".
+If the "cookieless" is not set to "UseCookies", this is a finding.
+
+Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</RawString>
+      <Value>UseCookies</Value>
+    </Rule>
+    <Rule id="V-100145.a" severity="medium" conversionstatus="pass" title="SRG-APP-000223-WSR-000145" dscresource="None">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session.
+
+When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-100143</DuplicateOf>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>cookieless</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+Verify the "cookieless" is set to "UseCookies".</RawString>
+      <Value>UseCookies</Value>
+    </Rule>
+    <Rule id="V-100149.a" severity="medium" conversionstatus="pass" title="SRG-APP-000231-WSR-000144" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/machineKey</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;The Machine Key element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. The Machine Key feature can be managed to specify hashing and encryption settings for application services such as view state, forms authentication, membership and roles, and anonymous identification. Ensuring a strong encryption method can mitigate the risk of data tampering in crucial functional areas such as forms authentication cookies, or view state.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>validation</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Double-click the "Machine Key" icon in the website Home Pane.
+If "HMACSHA256" or stronger encryption is not selected for the Validation method and/or "Auto" is not selected for the Encryption method, this is a finding.
+If .NET is not installed, this is Not Applicable.
+Verify "HMACSHA256"</RawString>
+      <Value>HMACSHA256</Value>
+    </Rule>
+    <Rule id="V-100149.b" severity="medium" conversionstatus="pass" title="SRG-APP-000231-WSR-000144" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/machineKey</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;The Machine Key element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. The Machine Key feature can be managed to specify hashing and encryption settings for application services such as view state, forms authentication, membership and roles, and anonymous identification. Ensuring a strong encryption method can mitigate the risk of data tampering in crucial functional areas such as forms authentication cookies, or view state.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>decryption</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Double-click the "Machine Key" icon in the website Home Pane.
+If "HMACSHA256" or stronger encryption is not selected for the Validation method and/or "Auto" is not selected for the Encryption method, this is a finding.
+If .NET is not installed, this is Not Applicable.
+"Auto" is selected for the Encryption method</RawString>
+      <Value>Auto</Value>
+    </Rule>
+    <Rule id="V-100151" severity="medium" conversionstatus="pass" title="SRG-APP-000251-WSR-000157" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/directoryBrowse</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled, the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>enabled</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Directory Browsing" icon.
+
+Under the “Actions” pane verify "Directory Browsing" is disabled.
+
+If “Directory Browsing” is not disabled, this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-100155" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000159" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/httpErrors</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>errormode</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Double-click the "Error Pages" icon.
+
+Click any error message, and then click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.
+
+If the feature setting is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</RawString>
+      <Value>DetailedLocalOnly</Value>
+    </Rule>
+    <Rule id="V-100175" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000152" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/asp/session</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>keepSessionIdSecure</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Under the "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select "system.webServer/asp".
+
+Expand the "session" section.
+
+Verify the "keepSessionIdSecure" is set to "True".
+
+If the "keepSessionIdSecure" is not set to "True", this is a finding.</RawString>
+      <Value>True</Value>
+    </Rule>
+    <Rule id="V-100183.a" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/isapiCgiRestriction</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;By allowing unspecified file extensions to execute, the web servers attack surface is significantly increased. This increased risk can be reduced by only allowing specific ISAPI extensions or CGI extensions to run on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>notListedCgisAllowed</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Double-click the "ISAPI and CGI restrictions" icon.
+Click “Edit Feature Settings".
+Verify the "Allow unspecified CGI modules" check box is not checked</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-100183.b" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/isapiCgiRestriction</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;By allowing unspecified file extensions to execute, the web servers attack surface is significantly increased. This increased risk can be reduced by only allowing specific ISAPI extensions or CGI extensions to run on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>notListedIsapisAllowed</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+Click the IIS 10.0 web server name.
+Double-click the "ISAPI and CGI restrictions" icon.
+Click “Edit Feature Settings".
+Verify the "Allow unspecified ISAPI modules" check box is not checked</RawString>
+      <Value>false</Value>
+    </Rule>
+  </WebConfigurationPropertyRule>
+  <WindowsFeatureRule dscresourcemodule="PSDscResources">
+    <Rule id="V-100133" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000085" dscresource="WindowsFeature">
+      <Description>&lt;VulnDiscussion&gt;A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol which, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.
+
+WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Name>Web-DAV-Publishing</Name>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the IIS 10.0 Manager.
+
+Click the IIS 10.0 web server name.
+
+Review the features listed under the “IIS" section.
+
+If the "WebDAV Authoring Rules" icon exists, this is a finding.</RawString>
+    </Rule>
+  </WindowsFeatureRule>
+</DISASTIG>
diff --git a/StigData/Processed/IISServer-8.5-1.7.org.default.xml b/source/StigData/Processed/IISServer-8.5-1.10.org.default.xml
similarity index 89%
rename from StigData/Processed/IISServer-8.5-1.7.org.default.xml
rename to source/StigData/Processed/IISServer-8.5-1.10.org.default.xml
index 75b70d5cc..a5087da80 100644
--- a/StigData/Processed/IISServer-8.5-1.7.org.default.xml
+++ b/source/StigData/Processed/IISServer-8.5-1.10.org.default.xml
@@ -5,7 +5,7 @@
     Each setting in this file is linked by STIG ID and the valid range is in an
     associated comment.
 -->
-<OrganizationalSettings fullversion="1.7">
+<OrganizationalSettings fullversion="1.10">
   <!-- Ensure ''V-76727.b'' -le '00:20:00'-->
   <OrganizationalSetting id="V-76727.b" Value="00:20:00" />
 </OrganizationalSettings>
diff --git a/StigData/Processed/IISServer-8.5-1.7.xml b/source/StigData/Processed/IISServer-8.5-1.10.xml
similarity index 97%
rename from StigData/Processed/IISServer-8.5-1.7.xml
rename to source/StigData/Processed/IISServer-8.5-1.10.xml
index 8e0ed943a..749b25008 100644
--- a/StigData/Processed/IISServer-8.5-1.7.xml
+++ b/source/StigData/Processed/IISServer-8.5-1.10.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IIS_8-5_Server_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_IIS_8-5_Server_STIG_V1R7_Manual-xccdf.xml" releaseinfo="Release: 7 Benchmark Date: 26 Apr 2019" title="IIS 8.5 Server Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.7" created="9/19/2019">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IIS_8-5_Server_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_IIS_8-5_Server_STIG_V1R10_Manual-xccdf.xml" releaseinfo="Release: 10 Benchmark Date: 24 Apr 2020" title="IIS 8.5 Server Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.10" created="5/20/2020">
   <DocumentRule dscresourcemodule="None">
     <Rule id="V-76679" severity="medium" conversionstatus="pass" title="SRG-APP-000015-WSR-000014" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.
@@ -449,8 +449,7 @@ Log record content that may be necessary to satisfy the requirement of this cont
       <LogTargetW3C />
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Note: If SSL is installed on load balancer through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server ONLY receives traffic from the load balancer, the SSL requirement must be met on the load balancer.
-Access the IIS 8.5 web server IIS Manager.
+      <RawString>Access the IIS 8.5 web server IIS Manager.
 Click the IIS 8.5 web server name.
 Under "IIS", double-click the "Logging" icon.
 Verify the "Format:" under "Log File" is configured to "W3C".
@@ -510,10 +509,9 @@ Right-click the log file name to review.
 Click “Properties”.
 Click the “Security” tab.
 Verify log file access is restricted as follows. Otherwise, this is a finding.
-Eventlog - Full Control
+
 SYSTEM - Full Control
-Administrators - Full Control
-Web Managers - Read</RawString>
+Administrators - Full Control</RawString>
     </Rule>
     <Rule id="V-76697" severity="medium" conversionstatus="pass" title="SRG-APP-000125-WSR-000071" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system or onto separate media than the system the web server is actually running on helps to assure that, in the event of a catastrophic system failure, the log records will be retained.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -700,21 +698,6 @@ Click “Start”, then click “Administrative Tools”, and then click “Serv
 Expand the roles node, then right-click “Print Services”, and then select “Remove Roles Services”.
 
 If the Internet Printing option is enabled, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76763" severity="medium" conversionstatus="pass" title="SRG-APP-000456-WSR-000187" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Several vulnerabilities are associated with older versions of web server software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining the web server at a current version makes the efforts of a malicious user more difficult.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Determine the most recent patch level of the IIS 8.5 software, as posted on the Microsoft website.
-
-Open the IIS 8.5 Manager.
-
-Click "Help", and select "About Internet Information Services".
-
-If the version is more than one version behind the most recent patch level, this is a finding.
-</RawString>
     </Rule>
     <Rule id="V-76765" severity="high" conversionstatus="pass" title="SRG-APP-000516-WSR-000079" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community.
@@ -745,14 +728,35 @@ If passwords have not been changed from the default, this is a finding.</RawStri
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>Open the IIS 8.5 Manager.
-
 Click the IIS 8.5 web server name.
-
 Double-click the “Authorization Rules” icon.
 
 If any user other than “Administrator” is listed, this is a finding.
+
+If .NET is not installed, this is Not Applicable.
 </RawString>
     </Rule>
+    <Rule id="V-95633" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000001" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Access the IIS 8.5 IIS Manager.
+
+Click the IIS 8.5 server.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
+
+Expand "siteDefaults".
+Expand "limits".
+
+Review the results and verify the value is greater than zero for the "maxconnections" parameter.
+
+If the maxconnections parameter is set to zero, this is a finding.</RawString>
+    </Rule>
   </ManualRule>
   <MimeTypeRule dscresourcemodule="xWebAdministration">
     <Rule id="V-76711.a" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
@@ -900,6 +904,15 @@ If any OS shell MIME types are configured, this is a finding.
           </Inheritance>
           <Rights>ReadAndExecute</Rights>
         </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
         <Entry>
           <Type>
           </Type>
@@ -909,6 +922,14 @@ If any OS shell MIME types are configured, this is a finding.
           </Inheritance>
           <Rights>ReadAndExecute,ListDirectory</Rights>
         </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
       </AccessControlEntry>
       <Description>&lt;VulnDiscussion&gt;This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
@@ -918,19 +939,17 @@ If any OS shell MIME types are configured, this is a finding.
       <OrganizationValueTestString />
       <Path>%SystemDrive%\inetpub</Path>
       <RawString>Open Explorer and navigate to the inetpub directory.
-
-Right-click inetpub and select “Properties”.
-
+Right-click "inetpub" and select "Properties".
 Click the "Security" tab.
-
 Verify the permissions for the following users; if the permissions are less restrictive, this is a finding.
 
 System: Full control
 Administrators: Full control
 TrustedInstaller: Full control
 ALL APPLICATION PACKAGES (built-in security group): Read and execute
+ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute
 Users: Read and execute, list folder contents
-Creator/Owner: Special permissions to subkeys</RawString>
+CREATOR OWNER: Full Control, Subfolders and files only</RawString>
     </Rule>
   </PermissionRule>
   <RegistryRule dscresourcemodule="PSDscResources">
@@ -1352,9 +1371,9 @@ Click the IIS 8.5 web server name.
 
 Double-click the "Error Pages" icon.
 
-Click each error message and click "Edit Feature Setting" from the "Actions" Pane.
+Click on any error message and click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages.
 
-If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</RawString>
+If the feature setting is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</RawString>
       <Value>DetailedLocalOnly</Value>
     </Rule>
     <Rule id="V-76757" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000152" dscresource="xWebConfigKeyValue">
diff --git a/StigData/Processed/IISServer-8.5-1.9.org.default.xml b/source/StigData/Processed/IISServer-8.5-1.9.org.default.xml
similarity index 100%
rename from StigData/Processed/IISServer-8.5-1.9.org.default.xml
rename to source/StigData/Processed/IISServer-8.5-1.9.org.default.xml
diff --git a/StigData/Processed/IISServer-8.5-1.9.xml b/source/StigData/Processed/IISServer-8.5-1.9.xml
similarity index 100%
rename from StigData/Processed/IISServer-8.5-1.9.xml
rename to source/StigData/Processed/IISServer-8.5-1.9.xml
diff --git a/source/StigData/Processed/IISSite-10.0-1.1.org.default.xml b/source/StigData/Processed/IISSite-10.0-1.1.org.default.xml
new file mode 100644
index 000000000..404c3970f
--- /dev/null
+++ b/source/StigData/Processed/IISSite-10.0-1.1.org.default.xml
@@ -0,0 +1,29 @@
+<!--
+    The organizational settings file is used to define the local organizations
+    preferred setting within an allowed range of the STIG.
+
+    Each setting in this file is linked by STIG ID and the valid range is in an
+    associated comment.
+-->
+<OrganizationalSettings fullversion="1.1">
+  <!-- Ensure ''V-100215'' -cmatch '^(Full|High)$'-->
+  <OrganizationalSetting id="V-100215" Value="Full" />
+  <!-- Ensure 'V-100227' -le 4096-->
+  <OrganizationalSetting id="V-100227" Value="4096" />
+  <!-- Ensure 'V-100229' -le 30000000-->
+  <OrganizationalSetting id="V-100229" Value="30000000" />
+  <!-- Ensure 'V-100231' -le 2048-->
+  <OrganizationalSetting id="V-100231" Value="2048" />
+  <!-- Ensure [TimeSpan]'V-100245' -le [TimeSpan]'00:20:00' -and [TimeSpan]'V-100245' -gt [TimeSpan]'00:00:00'-->
+  <OrganizationalSetting id="V-100245" Value="'00:20:00'" />
+  <!-- Ensure ''V-100247'' -le '00:20:00'-->
+  <OrganizationalSetting id="V-100247" Value="00:20:00" />
+  <!-- Ensure 'V-100265' -ne 0-->
+  <OrganizationalSetting id="V-100265" Value="35000" />
+  <!-- Ensure 'V-100267' -ne 0-->
+  <OrganizationalSetting id="V-100267" Value="1000000" />
+  <!-- Ensure 'V-100269' -ne 0-->
+  <OrganizationalSetting id="V-100269" Value="1000000" />
+  <!-- Ensure [TimeSpan]'V-100277' -le [TimeSpan]'00:05:00'-->
+  <OrganizationalSetting id="V-100277" Value="'00:05:00'" />
+</OrganizationalSettings>
diff --git a/source/StigData/Processed/IISSite-10.0-1.1.xml b/source/StigData/Processed/IISSite-10.0-1.1.xml
new file mode 100644
index 000000000..aa03ded14
--- /dev/null
+++ b/source/StigData/Processed/IISSite-10.0-1.1.xml
@@ -0,0 +1,1355 @@
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IIS_10-0_Site_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_IIS_10-0_Site_V1R1_Manual-xccdf.xml" releaseinfo="Release: 1 Benchmark Date: 20 Mar 2020" title="Microsoft IIS 10.0 Site Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.1" created="5/29/2020">
+  <DocumentRule dscresourcemodule="None">
+    <Rule id="V-100209" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000082" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings.
+
+For Handler Mappings, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 8. Handler Mappings at the site level take precedence over Handler Mappings at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 10.0. Handler Mappings at the site level take precedence over Handler Mappings at the server level.
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click "Handler Mappings".
+
+If any script file extensions from the black list are enabled, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100211" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000083" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings.
+
+For Request Filtering, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name to review.
+
+Double-click Request Filtering-&gt;File Name Extensions Tab.
+
+If any script file extensions from the black list are not denied, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100217" severity="medium" conversionstatus="pass" title="SRG-APP-000142-WSR-000089" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to use, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address.
+
+Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Right-click on the site name under review.
+Select "Edit Bindings".
+
+Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
+
+If both hostname entries and unique IP addresses are not configured to port 80 for HTTP and port 443 for HTTPS (or other approved and documented port), this is a finding.
+
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Note: If HTTP/Port 80 is not being used, and is not configured as above, this is not a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</RawString>
+    </Rule>
+    <Rule id="V-100249" severity="medium" conversionstatus="pass" title="SRG-APP-000316-WSR-000170" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.
+
+The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.
+
+The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Interview the System Administrator and Web Manager.
+
+Ask for documentation for the IIS 10.0 web server administration.
+
+Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps:
+
+Determine the respective website for the application at risk of an attack.
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Select the respective website.
+
+In the "Actions" pane, under "Manage Website", click "Stop".
+
+If necessary, stop all websites.
+
+If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS 10.0 Manager.
+
+In the "Actions" pane, under "Manage Server", click "Stop".
+
+If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100251" severity="medium" conversionstatus="pass" title="SRG-APP-000357-WSR-000150" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To make certain the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity.
+
+The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Under "IIS" double-click on the "Logging" icon.
+
+In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written.
+
+Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging.
+
+Under "Log File Rollover", verify "Do not create new log files" is not selected.
+
+Verify a schedule is configured to rollover log files on a regular basis.
+
+Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device.
+
+If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100253" severity="medium" conversionstatus="pass" title="SRG-APP-000383-WSR-000175" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.
+
+The web server must provide the capability to disable or deactivate network-related services deemed to be non-essential to the server mission, too unsecure, or prohibited by the PPSM CAL and vulnerability assessments.
+
+Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS.
+
+The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, PPSM, and the associated PPS Assurance Category Assignments List.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+In the "Action" Pane, click "Bindings".
+
+Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.</RawString>
+    </Rule>
+  </DocumentRule>
+  <IisLoggingRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100199" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="XWebsite">
+      <Description>&lt;VulnDiscussion&gt;Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.
+
+In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.
+
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry />
+      <LogFlags />
+      <LogFormat />
+      <LogPeriod />
+      <LogTargetW3C>File,ETW</LogTargetW3C>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.
+
+If the "Both log file and ETW event" radio button is not selected, this is a finding.
+
+Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting. More configuration information is available at:
+https://blogs.intelink.gov/blogs/_disairrt/?p=1317</RawString>
+    </Rule>
+    <Rule id="V-100203" severity="medium" conversionstatus="pass" title="SRG-APP-000099-WSR-000061" dscresource="XWebsite">
+      <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.
+
+Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Connection</SourceName>
+        </Entry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Warning</SourceName>
+        </Entry>
+      </LogCustomFieldEntry>
+      <LogFlags />
+      <LogFormat>W3C</LogFormat>
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Select the website being reviewed.
+
+Under "IIS", double-click the "Logging" icon.
+
+Verify the "Format:" under "Log File" is configured to "W3C".
+
+Select "Fields".
+
+Under "Custom Fields", verify the following fields are selected:
+
+Request Header &gt;&gt; Connection
+
+Request Header &gt;&gt; Warning
+
+If any of the above fields are not selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100205" severity="medium" conversionstatus="pass" title="SRG-APP-000100-WSR-000064" dscresource="XWebsite">
+      <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
+
+Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Authorization</SourceName>
+        </Entry>
+        <Entry>
+          <SourceType>ResponseHeader</SourceType>
+          <SourceName>Content-Type</SourceName>
+        </Entry>
+      </LogCustomFieldEntry>
+      <LogFlags>UserAgent,UserName,Referer</LogFlags>
+      <LogFormat>W3C</LogFormat>
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 web server IIS 10.0 Manager.
+
+Under "IIS", double-click the "Logging" icon.
+
+Verify the "Format:" under "Log File" is configured to "W3C".
+
+Select "Fields".
+
+Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected.
+
+Under "Custom Fields", verify the following fields have been configured:
+
+Request Header &gt;&gt; Authorization
+
+Response Header &gt;&gt; Content-Type
+
+If any of the above fields are not selected, this is a finding.</RawString>
+    </Rule>
+  </IisLoggingRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-100201" severity="medium" conversionstatus="pass" title="SRG-APP-000098-WSR-000060" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
+
+Ascertaining the correct source (e.g., source IP), of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the loggable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.
+
+A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy.
+
+If the IIS 10.0 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Click the "Logging" icon.
+
+Click "View log file".
+
+When log file is displayed, review source IP information in log entries and verify entries do not reflect the IP address of the proxy server.
+
+If the website is not behind a load balancer or proxy server, this is Not Applicable.
+
+If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
+
+If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-100221" severity="high" conversionstatus="pass" title="SRG-APP-000211-WSR-000031" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data stored on the web server must be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Check the account used for anonymous access to the website.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+
+Double-click "Authentication" in the IIS section of the website’s Home Pane.
+
+If Anonymous access is disabled, this is Not a Finding.
+
+If Anonymous access is enabled, click "Anonymous Authentication".
+
+Click "Edit" in the "Actions" pane.
+
+If the "Specific user" radio button is enabled and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Note: account name.
+
+Check privileged groups that may allow the anonymous account inappropriate membership:
+Open "Server Manager" on the machine.
+
+Expand Configuration.
+
+Expand Local Users and Groups.
+
+Click "Groups".
+
+Review members of any of the following privileged groups:
+
+Administrators
+Backup Operators
+Certificate Services (of any designation)
+Distributed COM Users
+Event Log Readers
+Network Configuration Operators
+Performance Log Users
+Performance Monitor Users
+Power Users
+Print Operators
+Remote Desktop Users
+Replicator
+
+Double-click each group and review its members.
+
+If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100225" severity="medium" conversionstatus="pass" title="SRG-APP-000233-WSR-000146" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file, the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Click the "Advanced Settings" from the "Actions" pane.
+
+Review the Physical Path.
+
+If the Path is on the same partition as the OS, this is a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</RawString>
+    </Rule>
+    <Rule id="V-100255" severity="medium" conversionstatus="pass" title="SRG-APP-000427-WSR-000186" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Click "Bindings" in the "Action" Pane.
+
+Click the "HTTPS type" from the box.
+
+Click "Edit".
+
+Click "View" and then review and verify the certificate path.
+
+If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding.
+
+If HTTPS is not an available type under site bindings, this is a finding.
+
+If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server with IP address and Domain Restrictions in place, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-100263" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+In the list of Application Pools, review the "Applications" column and verify unique application pools for each website.
+
+If any Application Pools are being used for more than one website, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100279" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the System Administrator (SA) control over what goes into those folders and to facilitate access control at the folder level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp.
+
+All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web site name and select "Explore".
+
+Search for the listed script extensions. Each script type must be in its unique designated folder.
+
+If scripts are not segregated from web content and in their own unique folders, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100281" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension.
+
+The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the System Administrator (SA) or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp.
+
+If the website does not utilize CGI, this finding is Not Applicable.
+
+All interactive programs must have restrictive permissions.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web site name and select "Explore".
+
+Search for the listed script extensions.
+
+Review the permissions to the CGI scripts and verify only the permissions listed, or more restrictive permissions are assigned.
+
+Administrators: FULL
+TrustedInstaller: FULL
+ALL APPLICATION PACKAGES: Read
+ALL RESTRICTED APPLICATION PACKAGES: Read
+SYSTEM: FULL
+ApplicationPoolId: READ
+Custom Service Account: READ
+Users: READ
+
+If the permissions are less restrictive than listed above, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100283" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. The scope of this requirement is to analyze only within the web server content directories, not the entire underlying operating system.
+
+If the website does not utilize CGI, this finding is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Right-click the IIS 10.0 web site name and select "Explore".
+
+Search for the listed script extensions
+
+Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.
+
+If files with these extensions are found, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-100285" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A consent banner will be in place to inform prospective entrants the website they are about to enter is a DoD website and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: This requirement is only applicable for private DoD websites.
+
+If a banner is required, the following banner page must be in place:
+
+“You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+- At any time, the USG may inspect and seize data stored on this IS.
+
+- Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+- This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy.
+
+- Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.”
+
+OR
+
+If your system cannot meet the character limits to store this amount of text in the banner, the following is another option for the warning banner:
+
+"I've read &amp; consent to terms in IS user agreem't."
+
+NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page.
+
+If the access-controlled website does not display this banner page before entry, this is a finding.</RawString>
+    </Rule>
+  </ManualRule>
+  <MimeTypeRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100207.a" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner.
+
+A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.exe</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/octet-stream</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+Click on the IIS 10.0 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.exe</RawString>
+    </Rule>
+    <Rule id="V-100207.b" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner.
+
+A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.dll</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-msdownload</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+Click on the IIS 10.0 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.dll</RawString>
+    </Rule>
+    <Rule id="V-100207.c" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner.
+
+A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.com</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/octet-stream</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+Click on the IIS 10.0 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.com</RawString>
+    </Rule>
+    <Rule id="V-100207.d" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner.
+
+A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.bat</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-bat</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+Click on the IIS 10.0 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.bat</RawString>
+    </Rule>
+    <Rule id="V-100207.e" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+      <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner.
+
+A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
+
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.csh</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-csh</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+Click on the IIS 10.0 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.csh</RawString>
+    </Rule>
+  </MimeTypeRule>
+  <SslSettingsRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100195" severity="medium" conversionstatus="pass" title="SRG-APP-000014-WSR-000006" dscresource="xSslSettings">
+      <Description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+
+Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Click the site name.
+Double-click the "SSL Settings" icon.
+Verify "Require SSL" check box is selected.
+
+If the "Require SSL" check box is not selected, this is a finding.</RawString>
+      <Value>Ssl</Value>
+    </Rule>
+    <Rule id="V-100197" severity="medium" conversionstatus="pass" title="SRG-APP-000014-WSR-000006" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
+
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-100195</DuplicateOf>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "SSL Settings" icon.
+
+Verify "Require SSL" check box is selected.
+
+If the "Require SSL" check box is not selected, this is a finding.</RawString>
+      <Value>Ssl</Value>
+    </Rule>
+    <Rule id="V-100219" severity="medium" conversionstatus="pass" title="SRG-APP-000172-WSR-000104" dscresource="xSslSettings">
+      <Description>&lt;VulnDiscussion&gt;A DoD private website must use PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites.
+
+Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable.
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Double-click the "SSL Settings" icon.
+
+Verify the "Clients Certificate Required" check box is selected.
+
+If the "Clients Certificate Required" check box is not selected, this is a finding.</RawString>
+      <Value>SslRequireCert</Value>
+    </Rule>
+    <Rule id="V-100257" severity="medium" conversionstatus="pass" title="SRG-APP-000429-WSR-000113" dscresource="xSslSettings">
+      <Description>&lt;VulnDiscussion&gt;When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server.
+
+Satisfies: SRG-APP-000429-WSR-000113, SRG-APP-000439-WSR-000151, SRG-APP-000441-WSR-000181, SRG-APP-000442-WSR-000182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
+
+Note: If this is a public facing web server, this requirement is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Double-click the "SSL Settings" icon under the "IIS" section.
+Verify "Require SSL" is checked.
+Verify "Client Certificates Required" is selected.
+Click the site under review.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.webServer/security/access".
+The value for "sslFlags" set must include "ssl128".
+
+If the "Require SSL" is not selected, this is a finding.
+If the "Client Certificates Required" is not selected, this is a finding.
+If the "sslFlags" is not set to "ssl128", this is a finding.</RawString>
+      <Value>Ssl,SslNegotiateCert,SslRequireCert,Ssl128</Value>
+    </Rule>
+  </SslSettingsRule>
+  <WebAppPoolRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100245" severity="medium" conversionstatus="pass" title="SRG-APP-000295-WSR-000012" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received.
+
+The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes.
+
+By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>idleTimeout</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>[TimeSpan]{0} -le [TimeSpan]'00:20:00' -and [TimeSpan]{0} -gt [TimeSpan]'00:00:00'</OrganizationValueTestString>
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+Click the Application Pools.
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is not "0".
+
+If the "Idle Time-out" is set to "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100265" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>restartRequestsLimit</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform for each Application Pool.
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0".
+
+If the "Request Limit" is set to a value of "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100267" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>restartMemoryLimit</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the Action Pane.
+
+In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to "0".
+
+If the value for "Virtual Memory Limit" is set to "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100269" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>restartPrivateMemoryLimit</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and verify the value for "Private Memory Limit" is set to a value other than "0".
+
+If the "Private Memory Limit" is set to a value of "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100271" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>logEventOnRecycle</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Perform the following for each Application Pool:
+
+Click "Application Pools".
+
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
+
+Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section.
+
+Verify both the "Regular time interval" and "Specific time" options are set to "True".
+
+If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.</RawString>
+      <Value>'Time,Schedule'</Value>
+    </Rule>
+    <Rule id="V-100273" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>pingingEnabled</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Open the Internet Information Services (IIS) Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Process Model" section and verify the value for "Ping Enabled" is set to "True".
+
+If the value for "Ping Enabled" is not set to "True", this is a finding.</RawString>
+      <Value>$true</Value>
+    </Rule>
+    <Rule id="V-100275" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection, the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>rapidFailProtection</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True".
+
+If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.</RawString>
+      <Value>$true</Value>
+    </Rule>
+    <Rule id="V-100277" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>rapidFailProtectionInterval</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>[TimeSpan]{0} -le [TimeSpan]'00:05:00'</OrganizationValueTestString>
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
+Open the IIS 10.0 Manager.
+
+Click "Application Pools".
+
+Perform the following for each Application Pool:
+
+Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
+
+Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5".
+
+If the "Failure Interval" is not set to "5" or less, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+  </WebAppPoolRule>
+  <WebConfigurationPropertyRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-100191" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000002" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is either stored in a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
+
+When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
+
+ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>mode</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State Mode Settings", verify the "In Process" mode is selected.
+
+If the "Session State Mode Settings" is set to "In Process", this is not a finding.
+
+Alternative method:
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "mode" reflects "InProc".
+
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.</RawString>
+      <Value>InProc</Value>
+    </Rule>
+    <Rule id="V-100193" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000002" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
+
+When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
+
+ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session.
+
+When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>cookieless</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+Open the IIS 10.0 Manager.
+Click the site name.
+Under the "ASP.NET" section, select "Session State".
+Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.
+If the "Use Cookies" mode is selected, this is not a finding.
+
+Alternative method:
+Click the site name.
+Select "Configuration Editor" under the "Management" section.
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+Verify the "cookieless" is set to "UseCookies".
+If the "cookieless" is not set to "UseCookies", this is a finding.
+Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</RawString>
+      <Value>UseCookies</Value>
+    </Rule>
+    <Rule id="V-100215" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000086" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/trust</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;A web server may host too many applications. Each application will need certain system resources and privileged operations to operate correctly. An application's trust level determines the permissions granted by the ASP.NET Code Access Security (CAS) policy. An application with full trust permissions may access all resource types on a server and perform privileged operations, while applications running with partial trust have varying levels of operating permissions and access to resources. The CAS determines the permissions granted to the application on the server. Setting a level of trust compatible with the applications will limit the potential harm a compromised application could cause to a system. The web server must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation.
+
+Limiting the application will confine the potential harm a compromised application could cause to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;The IIS 10.0 production website must configure the Global .NET Trust Level.&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>level</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>'{0}' -cmatch '^(Full|High)$'</OrganizationValueTestString>
+      <RawString>Note: If the server being reviewed is a non-production website, this is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the ".NET Trust Level" icon.
+
+If the ".NET Trust Level" is not set to Full or less, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100223" severity="medium" conversionstatus="pass" title="SRG-APP-000224-WSR-000136" dscresource="None">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. To maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application.
+
+By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID.
+
+The session ID generator must be a FIPS 140-2-approved generator.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-100191</DuplicateOf>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>mode</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State" Mode Settings, verify the "In Process" mode is selected.
+
+If the "In Process" mode is selected, this is not a finding.
+
+Alternative method:
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "mode" reflects "InProc".
+
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.</RawString>
+      <Value>InProc</Value>
+    </Rule>
+    <Rule id="V-100227" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>maxUrl</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -le 4096</OrganizationValueTestString>
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "maxUrl" value is not set to "4096" or less, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100229" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>maxAllowedContentLength</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -le 30000000</OrganizationValueTestString>
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click on the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100231" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>maxQueryString</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -le 2048</OrganizationValueTestString>
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click “Edit Feature Settings” in the "Actions" pane.
+
+If the "Maximum Query String" value is not set to "2048" or less, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100233" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>allowHighBitCharacters</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "Allow high-bit characters" check box is checked, this is a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-100235" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the "Allow double escaping" option is disabled, it prevents attacks that rely on double-encoded requests.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>allowDoubleEscaping</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "Allow double escaping" check box is checked, this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-100237" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/fileExtensions</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the "File Extensions Request" filter enables rejection of requests containing specific file extensions not defined in the "File Extensions" filter. Tripping this filter will cause IIS to generate a Status Code 404.7.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>allowUnlisted</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Double-click the "Request Filtering" icon.
+
+Click "Edit Feature Settings" in the "Actions" pane.
+
+If the "Allow unlisted file name extensions" check box is checked, this is a finding.
+
+Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-100239" severity="medium" conversionstatus="pass" title="SRG-APP-000251-WSR-000157" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/directoryBrowse</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>enabled</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Click the Site.
+
+Double-click the "Directory Browsing" icon.
+
+If "Directory Browsing" is not installed, this is Not Applicable.
+
+Under the "Actions" pane, verify "Directory Browsing" is "Disabled".
+
+If "Directory Browsing" is not "Disabled", this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-100241" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000159" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/httpErrors</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>errormode</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click the "Error Pages" icon.
+
+Click each error message and click "Edit Feature" setting from the "Actions" pane.
+
+If any error message is not set to "Detailed errors for local requests and custom error pages for remote requests", this is a finding.</RawString>
+      <Value>DetailedLocalOnly</Value>
+    </Rule>
+    <Rule id="V-100243" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000160" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/compilation</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>debug</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note: If the ".NET feature" is not installed, this check is Not Applicable.
+
+Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name under review.
+
+Double-click ".NET Compilation".
+
+Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False".
+
+If the "Debug" value is not set to "False", this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-100247" severity="medium" conversionstatus="pass" title="SRG-APP-000295-WSR-000134" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.
+
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>timeout</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>'{0}' -le '00:20:00'</OrganizationValueTestString>
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "timeout" is set to "00:20:00 or less”, using the lowest value possible depending upon the application.
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.
+
+If "timeout" is not set to "00:20:00 or less”, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-100259" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000152" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/asp/session</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>keepSessionIdSecure</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Access the IIS 10.0 Manager.
+
+Select the website being reviewed.
+
+Under "Management" section, double-click the "Configuration Editor" icon.
+
+From the "Section:" drop-down list, select "system.webServer/asp".
+
+Expand the "session" section.
+
+Verify the "keepSessionIdSecure" is set to "True".
+
+If the "keepSessionIdSecure" is not set to "True", this is a finding.</RawString>
+      <Value>True</Value>
+    </Rule>
+    <Rule id="V-100261.a" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000154" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/httpCookies</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e., HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.
+
+Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>requireSSL</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the "Section:" drop-down list, select "system.web/httpCookies".
+Verify the "require SSL" is set to "True".</RawString>
+      <Value>True</Value>
+    </Rule>
+    <Rule id="V-100261.b" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000154" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e., HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie.
+
+Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>compressionEnabled</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the "Section:" drop-down list, select "system.web/sessionState".
+Verify the "compressionEnabled" is set to "False".</RawString>
+      <Value>False</Value>
+    </Rule>
+  </WebConfigurationPropertyRule>
+  <WindowsFeatureRule dscresourcemodule="PSDscResources">
+    <Rule id="V-100213" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000085" dscresource="WindowsFeature">
+      <Description>&lt;VulnDiscussion&gt;A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.
+
+WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Name>Web-DAV-Publishing</Name>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 10.0 web server:
+
+Open the IIS 10.0 Manager.
+
+Select the IIS 10.0 website.
+
+Review the features listed under the "IIS" section.
+
+If the "WebDAV Authoring Rules" icon exists, this is a finding.</RawString>
+    </Rule>
+  </WindowsFeatureRule>
+</DISASTIG>
diff --git a/StigData/Processed/IISSite-8.5-1.8.org.default.xml b/source/StigData/Processed/IISSite-8.5-1.10.org.default.xml
similarity index 95%
rename from StigData/Processed/IISSite-8.5-1.8.org.default.xml
rename to source/StigData/Processed/IISSite-8.5-1.10.org.default.xml
index e9668f29f..4b74ed75a 100644
--- a/StigData/Processed/IISSite-8.5-1.8.org.default.xml
+++ b/source/StigData/Processed/IISSite-8.5-1.10.org.default.xml
@@ -1,31 +1,31 @@
-<!--
-    The organizational settings file is used to define the local organizations
-    preferred setting within an allowed range of the STIG.
-
-    Each setting in this file is linked by STIG ID and the valid range is in an
-    associated comment.
--->
-<OrganizationalSettings fullversion="1.8">
-  <!-- Ensure ''V-76805'' -cmatch '^(Full|High)$'-->
-  <OrganizationalSetting id="V-76805" Value="Full" />
-  <!-- Ensure 'V-76817' -le 4096-->
-  <OrganizationalSetting id="V-76817" Value="4096" />
-  <!-- Ensure 'V-76819' -le 30000000-->
-  <OrganizationalSetting id="V-76819" Value="30000000" />
-  <!-- Ensure 'V-76821' -le 2048-->
-  <OrganizationalSetting id="V-76821" Value="2048" />
-  <!-- Ensure [TimeSpan]'V-76839' -le [TimeSpan]'00:20:00' -and [TimeSpan]'V-76839' -gt [TimeSpan]'00:00:00'-->
-  <OrganizationalSetting id="V-76839" Value="'00:20:00'" />
-  <!-- Ensure ''V-76841'' -le '00:20:00'-->
-  <OrganizationalSetting id="V-76841" Value="00:20:00" />
-  <!-- Ensure 'V-76867' -ne 0-->
-  <OrganizationalSetting id="V-76867" Value="35000" />
-  <!-- Ensure 'V-76869' -ne 0-->
-  <OrganizationalSetting id="V-76869" Value="1000000" />
-  <!-- Ensure 'V-76871' -ne 0-->
-  <OrganizationalSetting id="V-76871" Value="1000000" />
-  <!-- Ensure 'V-76875' -le 1000-->
-  <OrganizationalSetting id="V-76875" Value="1000" />
-  <!-- Ensure [TimeSpan]'V-76881' -le [TimeSpan]'00:05:00'-->
-  <OrganizationalSetting id="V-76881" Value="'00:05:00'" />
-</OrganizationalSettings>
+<!--
+    The organizational settings file is used to define the local organizations
+    preferred setting within an allowed range of the STIG.
+
+    Each setting in this file is linked by STIG ID and the valid range is in an
+    associated comment.
+-->
+<OrganizationalSettings fullversion="1.10">
+  <!-- Ensure ''V-76805'' -cmatch '^(Full|High)$'-->
+  <OrganizationalSetting id="V-76805" Value="Full" />
+  <!-- Ensure 'V-76817' -le 4096-->
+  <OrganizationalSetting id="V-76817" Value="4096" />
+  <!-- Ensure 'V-76819' -le 30000000-->
+  <OrganizationalSetting id="V-76819" Value="30000000" />
+  <!-- Ensure 'V-76821' -le 2048-->
+  <OrganizationalSetting id="V-76821" Value="2048" />
+  <!-- Ensure [TimeSpan]'V-76839' -le [TimeSpan]'00:20:00' -and [TimeSpan]'V-76839' -gt [TimeSpan]'00:00:00'-->
+  <OrganizationalSetting id="V-76839" Value="'00:20:00'" />
+  <!-- Ensure ''V-76841'' -le '00:20:00'-->
+  <OrganizationalSetting id="V-76841" Value="00:20:00" />
+  <!-- Ensure 'V-76867' -ne 0-->
+  <OrganizationalSetting id="V-76867" Value="35000" />
+  <!-- Ensure 'V-76869' -ne 0-->
+  <OrganizationalSetting id="V-76869" Value="1000000" />
+  <!-- Ensure 'V-76871' -ne 0-->
+  <OrganizationalSetting id="V-76871" Value="1000000" />
+  <!-- Ensure 'V-76875' -le 1000-->
+  <OrganizationalSetting id="V-76875" Value="1000" />
+  <!-- Ensure [TimeSpan]'V-76881' -le [TimeSpan]'00:05:00'-->
+  <OrganizationalSetting id="V-76881" Value="'00:05:00'" />
+</OrganizationalSettings>
diff --git a/StigData/Processed/IISSite-8.5-1.8.xml b/source/StigData/Processed/IISSite-8.5-1.10.xml
similarity index 93%
rename from StigData/Processed/IISSite-8.5-1.8.xml
rename to source/StigData/Processed/IISSite-8.5-1.10.xml
index 5de7ab8f5..1e2cb3b56 100644
--- a/StigData/Processed/IISSite-8.5-1.8.xml
+++ b/source/StigData/Processed/IISSite-8.5-1.10.xml
@@ -1,99 +1,75 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IIS_8-5_Site_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_IIS_8-5_Site_V1R8_Manual-xccdf.xml" releaseinfo="Release: 8 Benchmark Date: 26 Jul 2019" title="IIS 8.5 Site Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.8" created="12/5/2019">
-  <DocumentRule dscresourcemodule="None">
-    <Rule id="V-76799" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000082" dscresource="None">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IIS_8-5_Site_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_IIS_8-5_Site_V1R10_Manual-xccdf.xml" releaseinfo="Release: 10 Benchmark Date: 24 Apr 2020" title="IIS 8.5 Site Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.10" created="5/20/2020">
+  <DocumentRule dscresourcemodule="None">
+    <Rule id="V-76799" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000082" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;IIS 8.5 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 8.5, “Request Filtering” and "Handler Mappings".
 
-For "Request Filtering", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>For "Request Filtering", the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8.5. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.
+For "Request Filtering", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 8.5. Handler Mappings at the site level take precedence over Handler Mappings at the server level.
 
 Open the IIS 8.5 Manager.
 
 Click the site name under review.
 
-Double-click Request Filtering-&gt;File Name Extensions Tab.
+Double-click "Handler Mappings".
 
-If any script file extensions from the black list are not denied, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76801" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000083" dscresource="None">
+If any script file extensions from the black list are enabled, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76801" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000083" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and to identify which file types are not to be delivered to a client.
 
 By not specifying which files can and which files cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc.
 
-The web server must only allow hosted application file types to be served to a user and all other types must be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>For "Handler Mappings", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Handler Mappings" in IIS 8.5. "Handler Mappings" at the site level take precedence over "Handler Mappings" at the server level.
+The web server must only allow hosted application file types to be served to a user and all other types must be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 8.5. Request Filtering at the site level take precedence over Request Filtering at the server level.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server: 
 
 Open the IIS 8.5 Manager.
+Click the site name to review.
+Double-click Request Filtering &gt;&gt; File Name Extensions Tab.
 
-Double-click "Request Filtering". 
-
-If any file name extensions from the black list have "Allowed" set to "True", this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76807" severity="medium" conversionstatus="pass" title="SRG-APP-000142-WSR-000089" dscresource="None">
+If any script file extensions from the black list are not denied, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76807" severity="medium" conversionstatus="pass" title="SRG-APP-000142-WSR-000089" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to utilize, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address.
 
-Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
-
 Right-click on the site name under review.
-
 Select “Edit Bindings”.
 
 Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used.
 
 If both hostname entries and unique IP addresses are not configure to port 80 for HTTP and port 443 for HTTPS (or other approved and documented port), this is a finding.
 
-Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.</RawString>
-    </Rule>
-    <Rule id="V-76831" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000142" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Note: This requirement is only for each site's root directory.
-
-Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Click the site name under review.
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
 
-Double-click "Default Document".
-
-In the "Actions" pane, verify the "Default Document" feature is enabled. 
-
-If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding.
-
-If "Default Document" is "Enabled, review the document types.
-
-Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory.
-
-If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76843" severity="medium" conversionstatus="pass" title="SRG-APP-000316-WSR-000170" dscresource="None">
+Note: If HTTP/Port 80 is not being used, and isn’t configured as above, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-76843" severity="medium" conversionstatus="pass" title="SRG-APP-000316-WSR-000170" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack.
 
 The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list.
 
-The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Interview the System Administrator and Web Manager.
 
 Ask for documentation for the IIS 8.5 web server administration.
@@ -114,16 +90,16 @@ If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS
 
 In the "Actions" pane, under "Manage Server", click on "Stop".
 
-If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76845" severity="medium" conversionstatus="pass" title="SRG-APP-000357-WSR-000150" dscresource="None">
+If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76845" severity="medium" conversionstatus="pass" title="SRG-APP-000357-WSR-000150" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;In order to make certain that the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism needs to be able to allocate log record storage capacity.
 
-The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Access the IIS 8.5 web server IIS 8.5 Manager.
@@ -140,20 +116,20 @@ Verify a schedule is configured to rollover log files on a regular basis.
 
 Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 8.5 web server to another logging device.
 
-If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76847" severity="medium" conversionstatus="pass" title="SRG-APP-000383-WSR-000175" dscresource="None">
+If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76847" severity="medium" conversionstatus="pass" title="SRG-APP-000383-WSR-000175" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system.
 
 The web server must provide the capability to disable or deactivate network-related services that are deemed to be non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.
 
 Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS.
 
-The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server:
@@ -164,27 +140,27 @@ Click the site name under review.
 
 In the “Action” Pane, click “Bindings”.
 
-Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.</RawString>
-    </Rule>
-  </DocumentRule>
-  <IisLoggingRule dscresourcemodule="xWebAdministration">
-    <Rule id="V-76783" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="XWebsite">
+Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.</RawString>
+    </Rule>
+  </DocumentRule>
+  <IisLoggingRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-76783" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="XWebsite">
       <Description>&lt;VulnDiscussion&gt;Log files are a critical component to the successful management of an IS used within the DoD. By generating log files with useful information web administrators can leverage them in the event of a disaster, malicious attack, or other site-specific needs.
 
 Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety.
 
 Without sufficient information establishing when the log event occurred, investigation into the cause of event is severely hindered. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.
 
-Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <LogCustomFieldEntry />
-      <LogFlags>Date,Time,ClientIP,UserName,Method,UriQuery,HttpStatus,Referer</LogFlags>
-      <LogFormat />
-      <LogPeriod />
-      <LogTargetW3C />
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry />
+      <LogFlags>Date,Time,ClientIP,UserName,Method,UriQuery,HttpStatus,Referer</LogFlags>
+      <LogFormat />
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -197,23 +173,23 @@ Under Format select "W3C".
 
 Click “Select Fields”, verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer.
 
-If the "W3C" is not selected as the logging format OR any of the required fields are not selected, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76785" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="XWebsite">
+If the "W3C" is not selected as the logging format OR any of the required fields are not selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76785" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="XWebsite">
       <Description>&lt;VulnDiscussion&gt;Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process.
 
 In IIS 8.5, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time.
 
-Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <LogCustomFieldEntry />
-      <LogFlags />
-      <LogFormat />
-      <LogPeriod />
-      <LogTargetW3C>File,ETW</LogTargetW3C>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry />
+      <LogFlags />
+      <LogFormat />
+      <LogPeriod />
+      <LogTargetW3C>File,ETW</LogTargetW3C>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -224,32 +200,32 @@ Click the "Logging" icon.
 
 Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected.
 
-If the "Both log file and ETW event" radio button is not selected, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76789" severity="medium" conversionstatus="pass" title="SRG-APP-000099-WSR-000061" dscresource="XWebsite">
+If the "Both log file and ETW event" radio button is not selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76789" severity="medium" conversionstatus="pass" title="SRG-APP-000099-WSR-000061" dscresource="XWebsite">
       <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
 
 Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the logable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise.
 
-Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <LogCustomFieldEntry>
-        <Entry>
-          <SourceType>RequestHeader</SourceType>
-          <SourceName>Connection</SourceName>
-        </Entry>
-        <Entry>
-          <SourceType>RequestHeader</SourceType>
-          <SourceName>Warning</SourceName>
-        </Entry>
-      </LogCustomFieldEntry>
-      <LogFlags />
-      <LogFormat>W3C</LogFormat>
-      <LogPeriod />
-      <LogTargetW3C />
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Connection</SourceName>
+        </Entry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Warning</SourceName>
+        </Entry>
+      </LogCustomFieldEntry>
+      <LogFlags />
+      <LogFormat>W3C</LogFormat>
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Select the website being reviewed.
@@ -266,32 +242,32 @@ Request Header &gt;&gt; Connection
 
 Request Header &gt;&gt; Warning
 
-If any of the above fields are not selected, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76791" severity="medium" conversionstatus="pass" title="SRG-APP-000100-WSR-000064" dscresource="XWebsite">
+If any of the above fields are not selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76791" severity="medium" conversionstatus="pass" title="SRG-APP-000100-WSR-000064" dscresource="XWebsite">
       <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined.
 
 Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools.
 
-Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <LogCustomFieldEntry>
-        <Entry>
-          <SourceType>RequestHeader</SourceType>
-          <SourceName>Authorization</SourceName>
-        </Entry>
-        <Entry>
-          <SourceType>ResponseHeader</SourceType>
-          <SourceName>Content-Type</SourceName>
-        </Entry>
-      </LogCustomFieldEntry>
-      <LogFlags>UserAgent,UserName,Referer</LogFlags>
-      <LogFormat>W3C</LogFormat>
-      <LogPeriod />
-      <LogTargetW3C />
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <LogCustomFieldEntry>
+        <Entry>
+          <SourceType>RequestHeader</SourceType>
+          <SourceName>Authorization</SourceName>
+        </Entry>
+        <Entry>
+          <SourceType>ResponseHeader</SourceType>
+          <SourceName>Content-Type</SourceName>
+        </Entry>
+      </LogCustomFieldEntry>
+      <LogFlags>UserAgent,UserName,Referer</LogFlags>
+      <LogFormat>W3C</LogFormat>
+      <LogPeriod />
+      <LogTargetW3C />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Access the IIS 8.5 web server IIS 8.5 Manager.
@@ -310,20 +286,20 @@ Request Header &gt;&gt; Authorization
 
 Response Header &gt;&gt; Content-Type
 
-If any of the above fields are not selected, this is a finding.</RawString>
-    </Rule>
-  </IisLoggingRule>
-  <ManualRule dscresourcemodule="None">
-    <Rule id="V-76787" severity="medium" conversionstatus="pass" title="SRG-APP-000098-WSR-000060" dscresource="None">
+If any of the above fields are not selected, this is a finding.</RawString>
+    </Rule>
+  </IisLoggingRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-76787" severity="medium" conversionstatus="pass" title="SRG-APP-000098-WSR-000060" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. 
 
 Ascertaining the correct source, e.g. source IP, of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the logable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise.
 
-A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy.
 
 If the IIS 8.5 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server.
@@ -344,36 +320,14 @@ If the website is not behind a load balancer or proxy server, this is Not Applic
 
 If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.
 
-If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</RawString>
-    </Rule>
-    <Rule id="V-76795" severity="medium" conversionstatus="pass" title="SRG-APP-000120-WSR-000070" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-Click the site name.
-Click the "Logging" icon.
-Click "Browse" and navigate to the directory where the log files are stored.
-Right-click the log file name to review and click “Properties”.
-Click the “Security” tab.
-Verify only authorized groups are listed, if others are listed, this is a finding.
-
-Note: The log file should be restricted as follows:
-Auditors - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
-Web Managers - Read</RawString>
-    </Rule>
-    <Rule id="V-76811" severity="high" conversionstatus="pass" title="SRG-APP-000211-WSR-000031" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-76811" severity="high" conversionstatus="pass" title="SRG-APP-000211-WSR-000031" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check the account used for anonymous access to the website.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server:
@@ -416,14 +370,50 @@ Users
 
 Double-click each group and review its members.
 
-If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76815" severity="medium" conversionstatus="pass" title="SRG-APP-000233-WSR-000146" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76813" severity="medium" conversionstatus="pass" title="SRG-APP-000224-WSR-000136" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application.
+
+By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID.
+
+The session ID generator also needs to be a FIPS 140-2-approved generator.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+
+Open the IIS 8.5 Manager.
+
+Click the site name.
+
+Under the "ASP.NET" section, select "Session State".
+
+Under "Session State" Mode Settings, verify the "In Process" mode is selected.
+
+If the "In Process" mode is selected, this is not a finding.
+
+Alternative method:
+
+Click the site name.
+
+Select "Configuration Editor" under the "Management" section.
+
+From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
+
+Verify the "mode" reflects "InProc".
+
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means.  If Session State Tracking is enabled on the Web Farm, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-76815" severity="medium" conversionstatus="pass" title="SRG-APP-000233-WSR-000146" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -434,14 +424,14 @@ Click the "Advanced Settings" from the "Actions" pane.
 
 Review the Physical Path.
 
-If the Path is on the same partition as the OS, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76849" severity="medium" conversionstatus="pass" title="SRG-APP-000427-WSR-000186" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the Path is on the same partition as the OS, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76849" severity="medium" conversionstatus="pass" title="SRG-APP-000427-WSR-000186" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -460,50 +450,52 @@ If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA,
 
 If HTTPS is not an available type under site bindings, this is a finding.
 
-If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server, with IP address and Domain Restrictions in place, this is not a finding.</RawString>
-    </Rule>
-    <Rule id="V-76865" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server, with IP address and Domain Restrictions in place, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-76865" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
 
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
+
 Open the IIS 8.5 Manager.
 
 Click "Application Pools".
 
 In the list of Application Pools, review the "Applications" column and verify unique application pools for each website.
 
-If any Application Pools are being used for more than one website, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76885" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the SA control over what goes into those folders and to facilitate access control at the folder level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp. 
+If any Application Pools are being used for more than one website, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76885" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the SA control over what goes into those folders and to facilitate access control at the folder level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp. 
 
-All interactive programs must be placed in unique designated folders based on CGI or ASP script type.
+All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders.
 
 Open the IIS 8.5 Manager.
 
-Right-click the IIS 8.5 web site name and select Explore.
+Right-click the IIS 8.5 web site name and select "Explore".
 
 Search for the listed script extensions. Each script type must be in its unique designated folder.
 
-If scripts are not segregated from web content and in their own unique folders, then this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76887" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
+If scripts are not segregated from web content and in their own unique folders, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76887" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension.
 
-The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the SA or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the SA or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
 
 If the website does not utilize CGI, this finding is Not Applicable.
@@ -526,14 +518,14 @@ ApplicationPoolId: READ
 Custom Service Account: READ
 Users: READ
 
-If the permissions are less restrictive than listed above, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76889" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the permissions are less restrictive than listed above, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76889" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000087" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx.
 
 If the website does not utilize CGI, this finding is Not Applicable.
@@ -546,14 +538,14 @@ Search for the listed script extensions
 
 Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”.
 
-If files with these extensions are found, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-76891" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;A consent banner will be in place to make prospective entrants aware that the website they are about to enter is a DoD web site and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If files with these extensions are found, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76891" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A consent banner will be in place to make prospective entrants aware that the website they are about to enter is a DoD web site and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: This requirement is only applicable for private DoD websites.
 
 If a banner is required, the following banner page must be in place: 
@@ -580,130 +572,130 @@ If your system cannot meet the character limits to store this amount of text in
 
 NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page. 
 
-If the access-controlled website does not display this banner page before entry, this is a finding.</RawString>
-    </Rule>
-  </ManualRule>
-  <MimeTypeRule dscresourcemodule="xWebAdministration">
-    <Rule id="V-76797.a" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+If the access-controlled website does not display this banner page before entry, this is a finding.</RawString>
+    </Rule>
+  </ManualRule>
+  <MimeTypeRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-76797.a" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
       <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
 
 A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
 
-A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Absent</Ensure>
-      <Extension>.exe</Extension>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MimeType>application/octet-stream</MimeType>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-Open the IIS 8.5 Manager.
-Click on the IIS 8.5 site.
-Under IIS, double-click the “MIME Types” icon.
-From the "Group by:" drop-down list, select "Content Type".
-From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
-If any OS shell MIME types are configured, this is a finding.
-.exe</RawString>
-    </Rule>
-    <Rule id="V-76797.b" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.exe</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/octet-stream</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+Open the IIS 8.5 Manager.
+Click on the IIS 8.5 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.exe</RawString>
+    </Rule>
+    <Rule id="V-76797.b" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
       <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
 
 A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
 
-A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Absent</Ensure>
-      <Extension>.dll</Extension>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MimeType>application/x-msdownload</MimeType>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-Open the IIS 8.5 Manager.
-Click on the IIS 8.5 site.
-Under IIS, double-click the “MIME Types” icon.
-From the "Group by:" drop-down list, select "Content Type".
-From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
-If any OS shell MIME types are configured, this is a finding.
-.dll</RawString>
-    </Rule>
-    <Rule id="V-76797.c" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.dll</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-msdownload</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+Open the IIS 8.5 Manager.
+Click on the IIS 8.5 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.dll</RawString>
+    </Rule>
+    <Rule id="V-76797.c" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
       <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
 
 A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
 
-A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Absent</Ensure>
-      <Extension>.com</Extension>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MimeType>application/octet-stream</MimeType>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-Open the IIS 8.5 Manager.
-Click on the IIS 8.5 site.
-Under IIS, double-click the “MIME Types” icon.
-From the "Group by:" drop-down list, select "Content Type".
-From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
-If any OS shell MIME types are configured, this is a finding.
-.com</RawString>
-    </Rule>
-    <Rule id="V-76797.d" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.com</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/octet-stream</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+Open the IIS 8.5 Manager.
+Click on the IIS 8.5 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.com</RawString>
+    </Rule>
+    <Rule id="V-76797.d" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
       <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
 
 A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
 
-A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Absent</Ensure>
-      <Extension>.bat</Extension>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MimeType>application/x-bat</MimeType>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-Open the IIS 8.5 Manager.
-Click on the IIS 8.5 site.
-Under IIS, double-click the “MIME Types” icon.
-From the "Group by:" drop-down list, select "Content Type".
-From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
-If any OS shell MIME types are configured, this is a finding.
-.bat</RawString>
-    </Rule>
-    <Rule id="V-76797.e" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.bat</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-bat</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+Open the IIS 8.5 Manager.
+Click on the IIS 8.5 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.bat</RawString>
+    </Rule>
+    <Rule id="V-76797.e" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping">
       <Description>&lt;VulnDiscussion&gt;Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner.
 
 A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type.
 
-A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Absent</Ensure>
-      <Extension>.csh</Extension>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MimeType>application/x-csh</MimeType>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-Open the IIS 8.5 Manager.
-Click on the IIS 8.5 site.
-Under IIS, double-click the “MIME Types” icon.
-From the "Group by:" drop-down list, select "Content Type".
-From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
-If any OS shell MIME types are configured, this is a finding.
-.csh</RawString>
-    </Rule>
-  </MimeTypeRule>
-  <SslSettingsRule dscresourcemodule="xWebAdministration">
-    <Rule id="V-76779" severity="medium" conversionstatus="pass" title="SRG-APP-000014-WSR-000006" dscresource="xSslSettings">
+A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <Extension>.csh</Extension>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MimeType>application/x-csh</MimeType>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
+Open the IIS 8.5 Manager.
+Click on the IIS 8.5 site.
+Under IIS, double-click the “MIME Types” icon.
+From the "Group by:" drop-down list, select "Content Type".
+From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions:
+If any OS shell MIME types are configured, this is a finding.
+.csh</RawString>
+    </Rule>
+  </MimeTypeRule>
+  <SslSettingsRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-76779" severity="medium" conversionstatus="pass" title="SRG-APP-000014-WSR-000006" dscresource="xSslSettings">
       <Description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
 
-FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
 
 Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
@@ -715,17 +707,17 @@ Click the site name.
 Double-click the "SSL Settings" icon.
 Verify "Require SSL" check box is selected.
 
-If the "Require SSL" check box is not selected, this is a finding.</RawString>
-      <Value>Ssl</Value>
-    </Rule>
-    <Rule id="V-76781" severity="medium" conversionstatus="pass" title="SRG-APP-000014-WSR-000006" dscresource="None">
+If the "Require SSL" check box is not selected, this is a finding.</RawString>
+      <Value>Ssl</Value>
+    </Rule>
+    <Rule id="V-76781" severity="medium" conversionstatus="pass" title="SRG-APP-000014-WSR-000006" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled.
 
-FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-76779</DuplicateOf>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-76779</DuplicateOf>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server:
@@ -738,31 +730,30 @@ Double-click the "SSL Settings" icon.
 
 Verify "Require SSL" check box is selected.
 
-If the "Require SSL" check box is not selected, this is a finding.</RawString>
-      <Value>Ssl</Value>
-    </Rule>
-    <Rule id="V-76809" severity="medium" conversionstatus="pass" title="SRG-APP-000172-WSR-000104" dscresource="xSslSettings">
+If the "Require SSL" check box is not selected, this is a finding.</RawString>
+      <Value>Ssl</Value>
+    </Rule>
+    <Rule id="V-76809" severity="medium" conversionstatus="pass" title="SRG-APP-000172-WSR-000104" dscresource="xSslSettings">
       <Description>&lt;VulnDiscussion&gt;A DoD private website must utilize PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites.
 
-Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
+Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
-
 Double-click the "SSL Settings" icon.
-
 Verify the "Clients Certificate Required" check box is selected.
 
-If the "Clients Certificate Required" check box is not selected, this is a finding.</RawString>
-      <Value>SslRequireCert</Value>
-    </Rule>
-    <Rule id="V-76851" severity="medium" conversionstatus="pass" title="SRG-APP-000429-WSR-000113" dscresource="xSslSettings">
+If the "Clients Certificate Required" check box is not selected, this is a finding.</RawString>
+      <Value>SslRequireCert</Value>
+    </Rule>
+    <Rule id="V-76851" severity="medium" conversionstatus="pass" title="SRG-APP-000429-WSR-000113" dscresource="xSslSettings">
       <Description>&lt;VulnDiscussion&gt;When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server.
 
 Preventing the disclosure of transmitted information requires that the web server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). 
@@ -771,11 +762,11 @@ Transmission of data can take place between the web server and a large number of
 
 If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information.
 
-Also satisfies: SRG-APP-000439-WSR-000151&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Also satisfies: SRG-APP-000439-WSR-000151&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server:
@@ -791,10 +782,10 @@ The value for "sslFlags" set must include "ssl128".
 
 If the "Require SSL" is not selected, this is a finding.
 If the "Client Certificates Required" is not selected, this is a finding.
-If the "sslFlags" is not set to "ssl128", this is a finding.</RawString>
-      <Value>Ssl,SslNegotiateCert,SslRequireCert,Ssl128</Value>
-    </Rule>
-    <Rule id="V-76861" severity="medium" conversionstatus="pass" title="SRG-APP-000441-WSR-000181" dscresource="None">
+If the "sslFlags" is not set to "ssl128", this is a finding.</RawString>
+      <Value>Ssl,SslNegotiateCert,SslRequireCert,Ssl128</Value>
+    </Rule>
+    <Rule id="V-76861" severity="medium" conversionstatus="pass" title="SRG-APP-000441-WSR-000181" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.
 
 An example of this would be an SMTP queue. This queue may be added to a web server through an SMTP module to enhance error reporting or to allow developers to add SMTP functionality to their applications. 
@@ -807,11 +798,11 @@ Protecting the confidentiality and integrity of received information requires th
 
 The web server must utilize approved encryption when receiving transmitted data.
 
-Also satisfies: SRG-APP-000442-WSR-000182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-76851</DuplicateOf>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Also satisfies: SRG-APP-000442-WSR-000182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-76851</DuplicateOf>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
 
 Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server.
@@ -829,118 +820,116 @@ The value for "sslFlags" should be “ssl128”.
 
 If the "Require SSL" is not selected, this is a finding.
 If the "Client Certificates Required" is not selected, this is a finding.
-If the "sslFlags" is not set to "ssl128", this is a finding.</RawString>
-      <Value>Ssl,SslNegotiateCert,SslRequireCert,Ssl128</Value>
-    </Rule>
-  </SslSettingsRule>
-  <WebAppPoolRule dscresourcemodule="xWebAdministration">
-    <Rule id="V-76839" severity="medium" conversionstatus="pass" title="SRG-APP-000295-WSR-000012" dscresource="xWebAppPool">
+If the "sslFlags" is not set to "ssl128", this is a finding.</RawString>
+      <Value>Ssl,SslNegotiateCert,SslRequireCert,Ssl128</Value>
+    </Rule>
+  </SslSettingsRule>
+  <WebAppPoolRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-76839" severity="medium" conversionstatus="pass" title="SRG-APP-000295-WSR-000012" dscresource="xWebAppPool">
       <Description>&lt;VulnDiscussion&gt;The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received.
 
 The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes.
 
-By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>idleTimeout</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>[TimeSpan]{0} -le [TimeSpan]'00:20:00' -and [TimeSpan]{0} -gt [TimeSpan]'00:00:00'</OrganizationValueTestString>
+By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>idleTimeout</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>[TimeSpan]{0} -le [TimeSpan]'00:20:00' -and [TimeSpan]{0} -gt [TimeSpan]'00:00:00'</OrganizationValueTestString>
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
-
 Click the Application Pools.
-
 Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane.
-
 Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is set to "20".
 
-If the "Idle Time-out" is not set to "20" or less, this is a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76867" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>restartRequestsLimit</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
-      <RawString>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO, this check can be downgraded to a Cat III.
-
-Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+If the "Idle Time-out" is not set to "20" or less, this is a finding.
+If the "Idle Time-out" is set to "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76867" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>restartRequestsLimit</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
 
 Open the IIS 8.5 Manager.
 
 Perform for each Application Pool.
 
-Click the “Application Pools”.
+Click "Application Pools".
 
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
 
 Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0".
 
-If the "Request Limit" is set to a value of "0", this is a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76869" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>restartMemoryLimit</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
-      <RawString>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, mitigation steps can be set, to include setting the “Fixed number or requests”, “Specific time”, and “Private memory usage” in the recycling conditions lieu of the “Virtual memory” setting. If mitigation is used in lieu of this requirement, with supporting documentation from the ISSO, this check can be downgraded to a Cat III.
-
-Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+If the "Request Limit" is set to a value of "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76869" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>restartMemoryLimit</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
 
 Open the IIS 8.5 Manager.
 
-Perform for each Application Pool.
+Perform the following for each Application Pool:
 
-Click on “Application Pools”.
+Click "Application Pools".
 
 Highlight an Application Pool and click "Advanced Settings" in the Action Pane.
 
-In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to 0.
-
-If the value for "Virtual Memory Limit" is set to 0, this is a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76871" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>restartPrivateMemoryLimit</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
-      <RawString>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III.
+In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to "0".
+
+If the value for "Virtual Memory Limit" is set to "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76871" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>restartPrivateMemoryLimit</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -ne 0</OrganizationValueTestString>
+      <RawString>Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
 
-Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.
+If this IIS 8.5 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.
 
 Open the IIS 8.5 Manager.
 
-Perform for each Application Pool.
+Perform the following for each Application Pool:
 
-Click the “Application Pools”.
+Click "Application Pools".
 
-Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane.
+Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane.
 
 Scroll down to the "Recycling" section and verify the value for "Private Memory Limit" is set to a value other than "0".
 
-If the "Private Memory Limit" is set to a value of "0", this is a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76873" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>logEventOnRecycle</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the "Private Memory Limit" is set to a value of "0", this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76873" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>logEventOnRecycle</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III.
 
 Open the IIS 8.5 Manager.
@@ -955,16 +944,16 @@ Scroll down to the "Recycling" section and expand the "Generate Recycle Event Lo
 
 Verify both the "Regular time interval" and "Specific time" options are set to "True".
 
-If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.</RawString>
-      <Value>'Time,Schedule'</Value>
-    </Rule>
-    <Rule id="V-76875" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;In order to determine the possible causes of client connection errors and to conserve system resources, it is important to both log errors and manage those settings controlling requests to the application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>queueLength</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>{0} -le 1000</OrganizationValueTestString>
+If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.</RawString>
+      <Value>'Time,Schedule'</Value>
+    </Rule>
+    <Rule id="V-76875" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;In order to determine the possible causes of client connection errors and to conserve system resources, it is important to both log errors and manage those settings controlling requests to the application pool.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>queueLength</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -le 1000</OrganizationValueTestString>
       <RawString>Open the IIS 8.5 Manager.
 
 Perform for each Application Pool.
@@ -975,17 +964,17 @@ Highlight an Application Pool to review and click "Advanced Settings" in the "Ac
 
 Scroll down to the "General" section and verify the value for "Queue Length" is set to 1000.
 
-If the "Queue Length" is set to "1000" or less, this is not a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76877" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>pingingEnabled</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the "Queue Length" is set to "1000" or less, this is not a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76877" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>pingingEnabled</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Open the Internet Information Services (IIS) Manager.
 
 Click the “Application Pools”.
@@ -996,16 +985,16 @@ Highlight an Application Pool to review and click "Advanced Settings" in the "Ac
 
 Scroll down to the "Process Model" section and verify the value for "Ping Enabled" is set to "True".
 
-If the value for "Ping Enabled" is not set to "True", this is a finding.</RawString>
-      <Value>$true</Value>
-    </Rule>
-    <Rule id="V-76879" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>rapidFailProtection</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the value for "Ping Enabled" is not set to "True", this is a finding.</RawString>
+      <Value>$true</Value>
+    </Rule>
+    <Rule id="V-76879" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>rapidFailProtection</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Open the IIS 8.5 Manager.
 
 Click the “Application Pools”.
@@ -1016,16 +1005,16 @@ Highlight an Application Pool to review and click "Advanced Settings" in the "Ac
 
 Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True".
 
-If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.</RawString>
-      <Value>$true</Value>
-    </Rule>
-    <Rule id="V-76881" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
-      <Description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>rapidFailProtectionInterval</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>[TimeSpan]{0} -le [TimeSpan]'00:05:00'</OrganizationValueTestString>
+If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.</RawString>
+      <Value>$true</Value>
+    </Rule>
+    <Rule id="V-76881" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebAppPool">
+      <Description>&lt;VulnDiscussion&gt;Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>rapidFailProtectionInterval</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>[TimeSpan]{0} -le [TimeSpan]'00:05:00'</OrganizationValueTestString>
       <RawString>Open the IIS 8.5 Manager.
 
 Click the “Application Pools”.
@@ -1036,24 +1025,24 @@ Highlight an Application Pool to review and click "Advanced Settings" in the "Ac
 
 Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5".
 
-If the "Failure Interval" is not set to "5" or less, this is a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-  </WebAppPoolRule>
-  <WebConfigurationPropertyRule dscresourcemodule="xWebAdministration">
-    <Rule id="V-76775" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000002" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.web/sessionState</ConfigSection>
+If the "Failure Interval" is not set to "5" or less, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+  </WebAppPoolRule>
+  <WebConfigurationPropertyRule dscresourcemodule="xWebAdministration">
+    <Rule id="V-76775" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000002" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
       <Description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
 
 When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
 
-ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>mode</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>mode</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1076,11 +1065,13 @@ From the "Section:" drop-down list at the top of the configuration editor, locat
 
 Verify the "mode" reflects "InProc".
 
-If the "mode" is not set to "InProc", this is a finding.</RawString>
-      <Value>InProc</Value>
-    </Rule>
-    <Rule id="V-76777" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000002" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.web/sessionState</ConfigSection>
+If the "mode" is not set to "InProc", this is a finding.
+
+If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means.  If Session State Tracking is enabled on the Web Farm, this is not a finding.</RawString>
+      <Value>InProc</Value>
+    </Rule>
+    <Rule id="V-76777" severity="medium" conversionstatus="pass" title="SRG-APP-000001-WSR-000002" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
       <Description>&lt;VulnDiscussion&gt;When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials.
 
 When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised.
@@ -1088,12 +1079,12 @@ When the user authorization and identity information is stored on the server in
 ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.
 
 Cookies associate session information with client information for the duration of a user’s connection to a website. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies because cookies do not require any redirection.
-&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>cookieless</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>cookieless</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 Open the IIS 8.5 Manager.
 Click the site name.
@@ -1107,19 +1098,19 @@ Select "Configuration Editor" under the "Management" section.
 From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
 Verify the "cookieless" is set to "UseCookies".
 If the "cookieless" is not set to "UseCookies", this is a finding.
-Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</RawString>
-      <Value>UseCookies</Value>
-    </Rule>
-    <Rule id="V-76805" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000086" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.web/trust</ConfigSection>
+Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.</RawString>
+      <Value>UseCookies</Value>
+    </Rule>
+    <Rule id="V-76805" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000086" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/trust</ConfigSection>
       <Description>&lt;VulnDiscussion&gt;A web server may host too many applications. Each application will need certain system resources and privileged operations to operate correctly. An application's trust level determines the permissions granted by the ASP.NET Code Access Security (CAS) policy. An application with full trust permissions may access all resource types on a server and perform privileged operations, while applications running with partial trust have varying levels of operating permissions and access to resources. The CAS determines the permissions granted to the application on the server. Setting a level of trust compatible with the applications will limit the potential harm a compromised application could cause to a system. The web server must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation.
 
-Limiting the application will confine the potential harm a compromised application could cause to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>level</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>'{0}' -cmatch '^(Full|High)$'</OrganizationValueTestString>
+Limiting the application will confine the potential harm a compromised application could cause to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>level</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>'{0}' -cmatch '^(Full|High)$'</OrganizationValueTestString>
       <RawString>Note: If the server being reviewed is a non-production website, this is Not Applicable.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server:
@@ -1131,55 +1122,18 @@ Click the site name under review.
 Double-click the ".NET Trust Level" icon.
 
 If the ".NET Trust Level" is not set to Full or less, this is a finding.
-</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76813" severity="medium" conversionstatus="pass" title="SRG-APP-000224-WSR-000136" dscresource="None">
-      <ConfigSection>/system.web/sessionState</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application.
-
-By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID.
-
-The session ID generator also needs to be a FIPS 140-2-approved generator.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-76775</DuplicateOf>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>mode</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
-
-Open the IIS 8.5 Manager.
-
-Click the site name.
-
-Under the "ASP.NET" section, select "Session State".
-
-Under "Session State" Mode Settings, verify the "In Process" mode is selected.
-
-If the "In Process" mode is selected, this is not a finding.
-
-Alternative method:
-
-Click the site name.
-
-Select "Configuration Editor" under the "Management" section.
-
-From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".
-
-Verify the "mode" reflects "InProc".
-
-If the "mode" is not set to "InProc", this is a finding.</RawString>
-      <Value>InProc</Value>
-    </Rule>
-    <Rule id="V-76817" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>maxUrl</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>{0} -le 4096</OrganizationValueTestString>
+</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76817" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>maxUrl</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -le 4096</OrganizationValueTestString>
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1190,18 +1144,18 @@ Double-click the "Request Filtering" icon.
 
 Click “Edit Feature Settings” in the "Actions" pane.
 
-If the "maxUrl" value is not set to "4096" or less, this is a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76819" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>maxAllowedContentLength</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>{0} -le 30000000</OrganizationValueTestString>
+If the "maxUrl" value is not set to "4096" or less, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76819" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>maxAllowedContentLength</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -le 30000000</OrganizationValueTestString>
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1213,18 +1167,18 @@ Double-click the "Request Filtering" icon.
 Click “Edit Feature Settings” in the "Actions" pane.
 
 If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.
-</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76821" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>maxQueryString</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>{0} -le 2048</OrganizationValueTestString>
+</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76821" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/requestlimits</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>maxQueryString</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} -le 2048</OrganizationValueTestString>
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1235,18 +1189,18 @@ Double-click the "Request Filtering" icon.
 
 Click “Edit Feature Settings” in the "Actions" pane.
 
-If the "Maximum Query String" value is not set to "2048" or less, this is a finding.</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76823" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/security/requestFiltering</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>allowHighBitCharacters</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the "Maximum Query String" value is not set to "2048" or less, this is a finding.</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76823" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>allowHighBitCharacters</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1257,17 +1211,17 @@ Double-click the "Request Filtering" icon.
 
 Click “Edit Feature Settings” in the "Actions" pane.
 
-If the "Allow high-bit characters" check box is checked, this is a finding.</RawString>
-      <Value>false</Value>
-    </Rule>
-    <Rule id="V-76825" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/security/requestFiltering</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the “Allow double escaping” option is disabled it prevents attacks that rely on double-encoded requests.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>allowDoubleEscaping</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the "Allow high-bit characters" check box is checked, this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-76825" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the “Allow double escaping” option is disabled it prevents attacks that rely on double-encoded requests.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>allowDoubleEscaping</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1278,17 +1232,17 @@ Double-click the "Request Filtering" icon.
 
 Click “Edit Feature Settings” in the "Actions" pane.
 
-If the "Allow double escaping" check box is checked, this is a finding.</RawString>
-      <Value>false</Value>
-    </Rule>
-    <Rule id="V-76827" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/security/requestFiltering/fileExtensions</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. By setting limits on web requests it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the “File Extensions Request” filter enables rejection of requests containing specific file extensions not defined in the “File Extensions” filter. Tripping this filter will cause IIS to generate a Status Code 404.7.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>allowUnlisted</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the "Allow double escaping" check box is checked, this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-76827" severity="medium" conversionstatus="pass" title="SRG-APP-000246-WSR-000149" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/security/requestFiltering/fileExtensions</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. By setting limits on web requests it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the “File Extensions Request” filter enables rejection of requests containing specific file extensions not defined in the “File Extensions” filter. Tripping this filter will cause IIS to generate a Status Code 404.7.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>allowUnlisted</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1299,17 +1253,17 @@ Double-click the "Request Filtering" icon.
 
 Click “Edit Feature Settings” in the "Actions" pane.
 
-If "Allow unlisted file name extensions" check box is checked, this is a finding.</RawString>
-      <Value>false</Value>
-    </Rule>
-    <Rule id="V-76829" severity="medium" conversionstatus="pass" title="SRG-APP-000251-WSR-000157" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/directoryBrowse</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>enabled</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If "Allow unlisted file name extensions" check box is checked, this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-76829" severity="medium" conversionstatus="pass" title="SRG-APP-000251-WSR-000157" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/directoryBrowse</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>enabled</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Click the Site.
@@ -1320,17 +1274,17 @@ If the "Directory Browsing" is not installed, this is Not Applicable.
 
 Under the "Actions" pane verify "Directory Browsing" is "Disabled".
 
-If "Directory Browsing" is not "Disabled", this is a finding.</RawString>
-      <Value>false</Value>
-    </Rule>
-    <Rule id="V-76835" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000159" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/httpErrors</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>errormode</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If "Directory Browsing" is not "Disabled", this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-76835" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000159" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/httpErrors</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>errormode</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1341,17 +1295,17 @@ Double-click the "Error Pages" icon.
 
 Click each error message and click "Edit Feature" setting from the "Actions" pane.
 
-If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</RawString>
-      <Value>DetailedLocalOnly</Value>
-    </Rule>
-    <Rule id="V-76837" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000160" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.web/compilation</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>debug</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</RawString>
+      <Value>DetailedLocalOnly</Value>
+    </Rule>
+    <Rule id="V-76837" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000160" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/compilation</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>debug</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Note: If the ".NET feature" is not installed, this check is Not Applicable.
 
 Follow the procedures below for each site hosted on the IIS 8.5 web server:
@@ -1364,19 +1318,19 @@ Double-click ".NET Compilation".
 
 Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False".
 
-If the "Debug" value is not set to "False", this is a finding.</RawString>
-      <Value>false</Value>
-    </Rule>
-    <Rule id="V-76841" severity="medium" conversionstatus="pass" title="SRG-APP-000295-WSR-000134" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.web/sessionState</ConfigSection>
+If the "Debug" value is not set to "False", this is a finding.</RawString>
+      <Value>false</Value>
+    </Rule>
+    <Rule id="V-76841" severity="medium" conversionstatus="pass" title="SRG-APP-000295-WSR-000134" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
       <Description>&lt;VulnDiscussion&gt;Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.
 
-Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>timeout</Key>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>'{0}' -le '00:20:00'</OrganizationValueTestString>
+Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>timeout</Key>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>'{0}' -le '00:20:00'</OrganizationValueTestString>
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1392,18 +1346,18 @@ Acceptable values are 5 minutes for high-value applications, 10 minutes for medi
 
 If "timeout" is not set to "00:20:00 or less”, this is a finding.
 
-</RawString>
-      <Value>
-      </Value>
-    </Rule>
-    <Rule id="V-76855" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000152" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.webServer/asp/session</ConfigSection>
-      <Description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data that is used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>keepSessionIdSecure</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+</RawString>
+      <Value>
+      </Value>
+    </Rule>
+    <Rule id="V-76855" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000152" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.webServer/asp/session</ConfigSection>
+      <Description>&lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data that is used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>keepSessionIdSecure</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Access the IIS 8.5 Manager.
@@ -1418,11 +1372,11 @@ Expand the "session" section.
 
 Verify the "keepSessionIdSecure" is set to "True".
 
-If the "keepSessionIdSecure" is not set to "True", this is a finding.</RawString>
-      <Value>True</Value>
-    </Rule>
-    <Rule id="V-76859.a" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000154" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.web/httpCookies</ConfigSection>
+If the "keepSessionIdSecure" is not set to "True", this is a finding.</RawString>
+      <Value>True</Value>
+    </Rule>
+    <Rule id="V-76859.a" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000154" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/httpCookies</ConfigSection>
       <Description>&lt;VulnDiscussion&gt;A cookie is used when a web server needs to share data with the client's browser. The data is often used to remember the client when the client returns to the hosted application at a later date. A session cookie is a special type of cookie used to remember the client during the session. The cookie will contain the session identifier (ID) and may contain authentication data to the hosted application. To protect this data from easily being compromised, the cookie must be encrypted. 
 
 When a cookie is sent encrypted via SSL/TLS, an attacker must spend a great deal of time and resources to decrypt the cookie. If, along with encryption, the cookie is compressed, the attacker can now use a combination of plaintext injection and inadvertent information leakage through data compression to reduce the time needed to decrypt the cookie. This attack is called Compression Ratio Info-leak Made Easy (CRIME). 
@@ -1433,18 +1387,18 @@ A cookie can be read by client-side scripts easily if cookie properties are not
 
 
 
-Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>requireSSL</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>From the "Section:" drop-down list, select "system.web/httpCookies".
-Verify the "require SSL" is set to "True".</RawString>
-      <Value>True</Value>
-    </Rule>
-    <Rule id="V-76859.b" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000154" dscresource="xWebConfigKeyValue">
-      <ConfigSection>/system.web/sessionState</ConfigSection>
+Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>requireSSL</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the "Section:" drop-down list, select "system.web/httpCookies".
+Verify the "require SSL" is set to "True".</RawString>
+      <Value>True</Value>
+    </Rule>
+    <Rule id="V-76859.b" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000154" dscresource="xWebConfigKeyValue">
+      <ConfigSection>/system.web/sessionState</ConfigSection>
       <Description>&lt;VulnDiscussion&gt;A cookie is used when a web server needs to share data with the client's browser. The data is often used to remember the client when the client returns to the hosted application at a later date. A session cookie is a special type of cookie used to remember the client during the session. The cookie will contain the session identifier (ID) and may contain authentication data to the hosted application. To protect this data from easily being compromised, the cookie must be encrypted. 
 
 When a cookie is sent encrypted via SSL/TLS, an attacker must spend a great deal of time and resources to decrypt the cookie. If, along with encryption, the cookie is compressed, the attacker can now use a combination of plaintext injection and inadvertent information leakage through data compression to reduce the time needed to decrypt the cookie. This attack is called Compression Ratio Info-leak Made Easy (CRIME). 
@@ -1455,28 +1409,28 @@ A cookie can be read by client-side scripts easily if cookie properties are not
 
 
 
-Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>compressionEnabled</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>From the "Section:" drop-down list, select "system.web/sessionState".
-Verify the "compressionEnabled" is set to "False".</RawString>
-      <Value>False</Value>
-    </Rule>
-  </WebConfigurationPropertyRule>
-  <WindowsFeatureRule dscresourcemodule="PSDscResources">
-    <Rule id="V-76803" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000085" dscresource="WindowsFeature">
+Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>compressionEnabled</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the "Section:" drop-down list, select "system.web/sessionState".
+Verify the "compressionEnabled" is set to "False".</RawString>
+      <Value>False</Value>
+    </Rule>
+  </WebConfigurationPropertyRule>
+  <WindowsFeatureRule dscresourcemodule="PSDscResources">
+    <Rule id="V-76803" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000085" dscresource="WindowsFeature">
       <Description>&lt;VulnDiscussion&gt;A web server can be installed with functionality that, just by its nature, is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors.
 
-WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Absent</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Name>Web-DAV-Publishing</Name>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Absent</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Name>Web-DAV-Publishing</Name>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Follow the procedures below for each site hosted on the IIS 8.5 web server:
 
 Open the IIS 8.5 Manager.
@@ -1485,7 +1439,7 @@ Select the IIS 8.5 website.
 
 Review the features listed under the "IIS" section.
 
-If the "WebDAV Authoring Rules" icon exists, this is a finding.</RawString>
-    </Rule>
-  </WindowsFeatureRule>
-</DISASTIG>
+If the "WebDAV Authoring Rules" icon exists, this is a finding.</RawString>
+    </Rule>
+  </WindowsFeatureRule>
+</DISASTIG>
diff --git a/StigData/Processed/IISSite-8.5-1.9.org.default.xml b/source/StigData/Processed/IISSite-8.5-1.9.org.default.xml
similarity index 100%
rename from StigData/Processed/IISSite-8.5-1.9.org.default.xml
rename to source/StigData/Processed/IISSite-8.5-1.9.org.default.xml
diff --git a/StigData/Processed/IISSite-8.5-1.9.xml b/source/StigData/Processed/IISSite-8.5-1.9.xml
similarity index 100%
rename from StigData/Processed/IISSite-8.5-1.9.xml
rename to source/StigData/Processed/IISSite-8.5-1.9.xml
diff --git a/StigData/Processed/InternetExplorer-11-1.17.org.default.xml b/source/StigData/Processed/InternetExplorer-11-1.17.org.default.xml
similarity index 100%
rename from StigData/Processed/InternetExplorer-11-1.17.org.default.xml
rename to source/StigData/Processed/InternetExplorer-11-1.17.org.default.xml
diff --git a/StigData/Processed/InternetExplorer-11-1.17.xml b/source/StigData/Processed/InternetExplorer-11-1.17.xml
similarity index 99%
rename from StigData/Processed/InternetExplorer-11-1.17.xml
rename to source/StigData/Processed/InternetExplorer-11-1.17.xml
index 9eeced2fa..4df640d5c 100644
--- a/StigData/Processed/InternetExplorer-11-1.17.xml
+++ b/source/StigData/Processed/InternetExplorer-11-1.17.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IE_11_STIG" description="The Microsoft Internet Explorer 11 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil" filename="U_MS_IE11_STIG_V1R17_Manual-xccdf.xml" releaseinfo="Release: 17 Benchmark Date: 26 Apr 2019" title="Microsoft Internet Explorer 11 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.17" created="12/5/2019">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IE_11_STIG" description="The Microsoft Internet Explorer 11 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil" filename="U_MS_IE11_STIG_V1R17_Manual-xccdf.xml" releaseinfo="Release: 17 Benchmark Date: 26 Apr 2019" title="Microsoft Internet Explorer 11 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.17" created="6/12/2020">
   <RegistryRule dscresourcemodule="PSDscResources">
     <Rule id="V-46473" severity="medium" conversionstatus="pass" title="DTBI014-IE11-TLS setting" dscresource="RegistryPolicyFile">
       <Description>&lt;VulnDiscussion&gt;This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other's list of supported protocols and versions and pick the most preferred match..&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1896,7 +1896,7 @@ If the value for "140C" is not REG_DWORD = 3, this is a finding.
 Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.
 </RawString>
       <ValueData>3</ValueData>
-      <ValueName>140C is not REG_DWORD = 3, this is a finding. Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and</ValueName>
+      <ValueName>140C</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
     <Rule id="V-75171" severity="medium" conversionstatus="pass" title="DTBI1130-IE11-VBScript" dscresource="RegistryPolicyFile">
@@ -1916,7 +1916,7 @@ If the value for "140C" is not REG_DWORD = 3, this is a finding.
 Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.
 </RawString>
       <ValueData>3</ValueData>
-      <ValueName>140C is not REG_DWORD = 3, this is a finding. Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and</ValueName>
+      <ValueName>140C</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
   </RegistryRule>
diff --git a/StigData/Processed/InternetExplorer-11-1.18.org.default.xml b/source/StigData/Processed/InternetExplorer-11-1.18.org.default.xml
similarity index 100%
rename from StigData/Processed/InternetExplorer-11-1.18.org.default.xml
rename to source/StigData/Processed/InternetExplorer-11-1.18.org.default.xml
diff --git a/StigData/Processed/InternetExplorer-11-1.18.xml b/source/StigData/Processed/InternetExplorer-11-1.18.xml
similarity index 99%
rename from StigData/Processed/InternetExplorer-11-1.18.xml
rename to source/StigData/Processed/InternetExplorer-11-1.18.xml
index 066f7c829..0491c08ab 100644
--- a/StigData/Processed/InternetExplorer-11-1.18.xml
+++ b/source/StigData/Processed/InternetExplorer-11-1.18.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IE_11_STIG" description="The Microsoft Internet Explorer 11 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil" filename="U_MS_IE11_STIG_V1R18_Manual-xccdf.xml" releaseinfo="Release: 18 Benchmark Date: 25 Oct 2019" title="Microsoft Internet Explorer 11 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.18" created="12/5/2019">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="IE_11_STIG" description="The Microsoft Internet Explorer 11 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil" filename="U_MS_IE11_STIG_V1R18_Manual-xccdf.xml" releaseinfo="Release: 18 Benchmark Date: 25 Oct 2019" title="Microsoft Internet Explorer 11 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.18" created="6/12/2020">
   <RegistryRule dscresourcemodule="PSDscResources">
     <Rule id="V-46473" severity="medium" conversionstatus="pass" title="DTBI014-IE11-TLS setting" dscresource="RegistryPolicyFile">
       <Description>&lt;VulnDiscussion&gt;This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other's list of supported protocols and versions and pick the most preferred match..&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1896,7 +1896,7 @@ If the value for "140C" is not REG_DWORD = 3, this is a finding.
 Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.
 </RawString>
       <ValueData>3</ValueData>
-      <ValueName>140C is not REG_DWORD = 3, this is a finding. Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and</ValueName>
+      <ValueName>140C</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
     <Rule id="V-75171" severity="medium" conversionstatus="pass" title="DTBI1130-IE11-VBScript" dscresource="RegistryPolicyFile">
@@ -1916,7 +1916,7 @@ If the value for "140C" is not REG_DWORD = 3, this is a finding.
 Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and is otherwise not applicable.
 </RawString>
       <ValueData>3</ValueData>
-      <ValueName>140C is not REG_DWORD = 3, this is a finding. Note: This policy setting will only exist on Windows 10 Redstone 2 or later, and</ValueName>
+      <ValueName>140C</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
     <Rule id="V-97527" severity="low" conversionstatus="pass" title="DTBI1135-IE11 - Developer Tools" dscresource="RegistryPolicyFile">
diff --git a/StigData/Processed/McAfee-8.8-VirusScan-5.16.org.default.xml b/source/StigData/Processed/McAfee-8.8-VirusScan-5.16.org.default.xml
similarity index 100%
rename from StigData/Processed/McAfee-8.8-VirusScan-5.16.org.default.xml
rename to source/StigData/Processed/McAfee-8.8-VirusScan-5.16.org.default.xml
diff --git a/StigData/Processed/McAfee-8.8-VirusScan-5.16.xml b/source/StigData/Processed/McAfee-8.8-VirusScan-5.16.xml
similarity index 100%
rename from StigData/Processed/McAfee-8.8-VirusScan-5.16.xml
rename to source/StigData/Processed/McAfee-8.8-VirusScan-5.16.xml
diff --git a/StigData/Processed/Office-Excel2013-1.7.org.default.xml b/source/StigData/Processed/Office-Excel2013-1.7.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-Excel2013-1.7.org.default.xml
rename to source/StigData/Processed/Office-Excel2013-1.7.org.default.xml
diff --git a/StigData/Processed/Office-Excel2013-1.7.xml b/source/StigData/Processed/Office-Excel2013-1.7.xml
similarity index 100%
rename from StigData/Processed/Office-Excel2013-1.7.xml
rename to source/StigData/Processed/Office-Excel2013-1.7.xml
diff --git a/StigData/Processed/Office-Excel2016-1.2.org.default.xml b/source/StigData/Processed/Office-Excel2016-1.2.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-Excel2016-1.2.org.default.xml
rename to source/StigData/Processed/Office-Excel2016-1.2.org.default.xml
diff --git a/StigData/Processed/Office-Excel2016-1.2.xml b/source/StigData/Processed/Office-Excel2016-1.2.xml
similarity index 100%
rename from StigData/Processed/Office-Excel2016-1.2.xml
rename to source/StigData/Processed/Office-Excel2016-1.2.xml
diff --git a/StigData/Processed/Office-Outlook2013-1.12.org.default.xml b/source/StigData/Processed/Office-Outlook2013-1.12.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-Outlook2013-1.12.org.default.xml
rename to source/StigData/Processed/Office-Outlook2013-1.12.org.default.xml
diff --git a/StigData/Processed/Office-Outlook2013-1.12.xml b/source/StigData/Processed/Office-Outlook2013-1.12.xml
similarity index 100%
rename from StigData/Processed/Office-Outlook2013-1.12.xml
rename to source/StigData/Processed/Office-Outlook2013-1.12.xml
diff --git a/StigData/Processed/Office-Outlook2013-1.13.org.default.xml b/source/StigData/Processed/Office-Outlook2013-1.13.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-Outlook2013-1.13.org.default.xml
rename to source/StigData/Processed/Office-Outlook2013-1.13.org.default.xml
diff --git a/StigData/Processed/Office-Outlook2013-1.13.xml b/source/StigData/Processed/Office-Outlook2013-1.13.xml
similarity index 100%
rename from StigData/Processed/Office-Outlook2013-1.13.xml
rename to source/StigData/Processed/Office-Outlook2013-1.13.xml
diff --git a/StigData/Processed/Office-Outlook2016-1.2.org.default.xml b/source/StigData/Processed/Office-Outlook2016-1.2.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-Outlook2016-1.2.org.default.xml
rename to source/StigData/Processed/Office-Outlook2016-1.2.org.default.xml
diff --git a/StigData/Processed/Office-Outlook2016-1.2.xml b/source/StigData/Processed/Office-Outlook2016-1.2.xml
similarity index 100%
rename from StigData/Processed/Office-Outlook2016-1.2.xml
rename to source/StigData/Processed/Office-Outlook2016-1.2.xml
diff --git a/StigData/Processed/Office-PowerPoint2013-1.6.org.default.xml b/source/StigData/Processed/Office-PowerPoint2013-1.6.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-PowerPoint2013-1.6.org.default.xml
rename to source/StigData/Processed/Office-PowerPoint2013-1.6.org.default.xml
diff --git a/StigData/Processed/Office-PowerPoint2013-1.6.xml b/source/StigData/Processed/Office-PowerPoint2013-1.6.xml
similarity index 100%
rename from StigData/Processed/Office-PowerPoint2013-1.6.xml
rename to source/StigData/Processed/Office-PowerPoint2013-1.6.xml
diff --git a/StigData/Processed/Office-PowerPoint2016-1.1.org.default.xml b/source/StigData/Processed/Office-PowerPoint2016-1.1.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-PowerPoint2016-1.1.org.default.xml
rename to source/StigData/Processed/Office-PowerPoint2016-1.1.org.default.xml
diff --git a/StigData/Processed/Office-PowerPoint2016-1.1.xml b/source/StigData/Processed/Office-PowerPoint2016-1.1.xml
similarity index 100%
rename from StigData/Processed/Office-PowerPoint2016-1.1.xml
rename to source/StigData/Processed/Office-PowerPoint2016-1.1.xml
diff --git a/StigData/Processed/Office-System2013-1.9.org.default.xml b/source/StigData/Processed/Office-System2013-1.9.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-System2013-1.9.org.default.xml
rename to source/StigData/Processed/Office-System2013-1.9.org.default.xml
diff --git a/StigData/Processed/Office-System2013-1.9.xml b/source/StigData/Processed/Office-System2013-1.9.xml
similarity index 100%
rename from StigData/Processed/Office-System2013-1.9.xml
rename to source/StigData/Processed/Office-System2013-1.9.xml
diff --git a/StigData/Processed/Office-System2016-1.1.org.default.xml b/source/StigData/Processed/Office-System2016-1.1.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-System2016-1.1.org.default.xml
rename to source/StigData/Processed/Office-System2016-1.1.org.default.xml
diff --git a/StigData/Processed/Office-System2016-1.1.xml b/source/StigData/Processed/Office-System2016-1.1.xml
similarity index 100%
rename from StigData/Processed/Office-System2016-1.1.xml
rename to source/StigData/Processed/Office-System2016-1.1.xml
diff --git a/StigData/Processed/SqlServer-2016-Instance-1.7.org.default.xml b/source/StigData/Processed/Office-Visio2013-1.4.org.default.xml
similarity index 84%
rename from StigData/Processed/SqlServer-2016-Instance-1.7.org.default.xml
rename to source/StigData/Processed/Office-Visio2013-1.4.org.default.xml
index b0666d92f..75d3babb6 100644
--- a/StigData/Processed/SqlServer-2016-Instance-1.7.org.default.xml
+++ b/source/StigData/Processed/Office-Visio2013-1.4.org.default.xml
@@ -5,4 +5,4 @@
     Each setting in this file is linked by STIG ID and the valid range is in an
     associated comment.
 -->
-<OrganizationalSettings fullversion="1.7" />
+<OrganizationalSettings fullversion="1.4" />
diff --git a/source/StigData/Processed/Office-Visio2013-1.4.xml b/source/StigData/Processed/Office-Visio2013-1.4.xml
new file mode 100644
index 000000000..adc652bdd
--- /dev/null
+++ b/source/StigData/Processed/Office-Visio2013-1.4.xml
@@ -0,0 +1,257 @@
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Microsoft_Visio_2013" description="The Microsoft Visio 2013 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.  Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Visio_2013_STIG_V1R4_Manual-xccdf.xml" releaseinfo="Release: 4 Benchmark Date: 27 Apr 2018" title="Microsoft Visio 2013 STIG" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.4" created="5/28/2020">
+  <RegistryRule dscresourcemodule="PSDscResources">
+    <Rule id="V-40730" severity="medium" conversionstatus="pass" title="DTOO104 - Disabling of user name and password" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate Website but actually opens a deceptive (spoofed) Website. For example, the URL http://www.wingtiptoys.com@example.com appears to open http://www.wingtiptoys.com but actually opens http://example.com. To protect users from such attacks, Internet Explorer usually blocks any URLs using this syntax.
+
+This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). If user names and passwords in URLs are allowed, users could be diverted to dangerous Web pages, which could pose a security risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Disable user name and password" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40731" severity="medium" conversionstatus="pass" title="DTOO111 - IE Bind to Object" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Internet Explorer performs a number of safety checks before initializing an ActiveX control. It will not initialize a control if the kill bit for the control is set in the registry, or if the security settings for the zone in which the control is located do not allow it to be initialized.
+This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). A security risk could occur if potentially dangerous controls are allowed to load.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Bind to object" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40732" severity="medium" conversionstatus="pass" title="DTOO117 - Saved from URL" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Typically, when Internet Explorer loads a web page from a Universal Naming Convention (UNC) share that contains a Mark of the Web (MOTW) comment, indicating the page was saved from a site on the Internet; Internet Explorer runs the page in the Internet security zone instead of the less restrictive Local Intranet security zone. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer does not evaluate the page for a MOTW, potentially dangerous code could be allowed to run.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Saved from URL" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40733" severity="medium" conversionstatus="pass" title="DTOO123 - Block Navigation to URL from Office " dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;To protect users from attacks, Internet Explorer usually does not attempt to load malformed URLs. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer attempts to load a malformed URL, a security risk could occur.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Navigate URL" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40734" severity="medium" conversionstatus="pass" title="DTOO124 - Scripted Window Security" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site to take control of the users' computers in some manner. Disabling or not configuring this setting allows unknown websites to:
+-Create browser windows appearing to be from the local operating system.
+-Draw active windows displaying outside of the viewable areas of the screen capturing keyboard input.
+-Overlay parent windows with their own browser windows to hide important system information, choices or prompts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Scripted Window Security Restrictions" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40735" severity="medium" conversionstatus="pass" title="DTOO126 - Add-on Management" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons may contain viruses or other malicious code. Disabling or not configuring this setting could allow malicious code or users to become active on user computers or the network. For example, a malicious user can monitor and then use keystrokes users type into Internet Explorer. Even legitimate add-ons may demand resources, compromising the performance of Internet Explorer, and the operating systems for user computers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\software\Microsoft\internet explorer\main\featurecontrol\feature_addon_management</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Add-on Management" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\software\Microsoft\internet explorer\main\featurecontrol\feature_addon_management
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40736" severity="medium" conversionstatus="pass" title="DTOO127 - Add-ins are signed by Trusted Publisher" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Office 2013 applications do not check the digital signature on application add-ins before opening them.  Disabling or not configuring this setting may allow an application to load a dangerous add-in.  As a result, malicious code could become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_CURRENT_USER\software\policies\Microsoft\office\15.0\Visio\security</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "Require that application add-ins are signed by Trusted Publisher" is set to "Enabled".
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKCU\software\policies\Microsoft\office\15.0\Visio\security
+
+Criteria: If the value requireaddinsig is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>requireaddinsig</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40737" severity="medium" conversionstatus="pass" title="DTOO129 - Block Pop-Ups" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;The Pop-up Blocker feature in Internet Explorer can be used to block most unwanted pop-up and pop-under windows from appearing. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). If the Pop-up Blocker is disabled, disruptive and potentially dangerous pop-up windows could load and present a security risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Block popups" is "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40738" severity="medium" conversionstatus="pass" title="DTOO131 - Trust Bar Notifications" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;If an application is configured to require all add-ins to be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message informing users about the unsigned add-in. If a user is allowed to make the determination to allow an unsigned add-in, it increases the risk of malicious code being introduced onto the user's computer or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_CURRENT_USER\software\policies\Microsoft\office\15.0\Visio\security</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled".
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKCU\software\policies\Microsoft\office\15.0\Visio\security
+
+Criteria: If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>notbpromptunsignedaddin</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40739" severity="medium" conversionstatus="pass" title="DTOO132 - Restrict File Download" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the download. User preferences may also allow the download to occur without prompting or interaction with the user. Even if Internet Explorer prompts the user to accept the download, some websites abuse this functionality. Malicious websites may continually prompt users to download a file or present confusing dialog boxes to trick users into downloading or running a file. If the download occurs and it contains malicious code, the code could become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Restrict File Download" is set to "Enabled" and 'Visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40740" severity="medium" conversionstatus="pass" title="DTOO209 - Zone Elevation Protection" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine zone, making this security zone a prime target for malicious users and code. Disabling or not configuring this setting could allow pages in the Internet zone to navigate to pages in the Local Machine zone to then run code to elevate privileges. This could allow malicious code or users to become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Protection From Zone Elevation" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40741" severity="medium" conversionstatus="pass" title="DTOO211 - Restrict ActiveX Install" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like the other types of HTML or Microsoft Silverlight-based controls. Disabling or not configuring this setting does not block prompts for ActiveX control installations and these prompts display to users. This could allow malicious code to become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Microsoft Office 2013 (Machine) -&gt; Security Settings -&gt; IE Security "Restrict ActiveX Install" is set to "Enabled" and 'visio.exe' is checked.
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL
+
+Criteria: If the value visio.exe is REG_DWORD = 1, this is not a finding.</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>visio.exe</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-40742" severity="medium" conversionstatus="pass" title="DTOO304 - VBA Macro Warning settings" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;When users open files containing VBA Macros, applications open the files with the macros disabled and displays the Trust Bar with a warning that macros are present and have been disabled. Users may then enable these macros by clicking Options on the Trust Bar and selecting the option to enable them. Disabling or not configuring this setting may allow dangerous macros to become active on user computers or the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_CURRENT_USER\software\policies\Microsoft\office\15.0\Visio\security</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the policy value for User Configuration -&gt; Administrative Templates -&gt; Microsoft Visio 2013 -&gt; Visio Options -&gt; Security -&gt; Trust Center -&gt; "VBA Macro Notification Settings" is set to "Enabled: Disable all with notification".
+
+Procedure: Use the Windows Registry Editor to navigate to the following key: 
+
+HKCU\software\policies\Microsoft\office\15.0\Visio\security
+
+Criteria: If the value vbawarnings is REG_DWORD = 2, this is not a finding.</RawString>
+      <ValueData>2</ValueData>
+      <ValueName>vbawarnings</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+  </RegistryRule>
+</DISASTIG>
diff --git a/StigData/Processed/Office-Word2013-1.6.org.default.xml b/source/StigData/Processed/Office-Word2013-1.6.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-Word2013-1.6.org.default.xml
rename to source/StigData/Processed/Office-Word2013-1.6.org.default.xml
diff --git a/StigData/Processed/Office-Word2013-1.6.xml b/source/StigData/Processed/Office-Word2013-1.6.xml
similarity index 100%
rename from StigData/Processed/Office-Word2013-1.6.xml
rename to source/StigData/Processed/Office-Word2013-1.6.xml
diff --git a/StigData/Processed/Office-Word2016-1.1.org.default.xml b/source/StigData/Processed/Office-Word2016-1.1.org.default.xml
similarity index 100%
rename from StigData/Processed/Office-Word2016-1.1.org.default.xml
rename to source/StigData/Processed/Office-Word2016-1.1.org.default.xml
diff --git a/StigData/Processed/Office-Word2016-1.1.xml b/source/StigData/Processed/Office-Word2016-1.1.xml
similarity index 100%
rename from StigData/Processed/Office-Word2016-1.1.xml
rename to source/StigData/Processed/Office-Word2016-1.1.xml
diff --git a/StigData/Processed/OracleJRE-8-1.5.org.default.xml b/source/StigData/Processed/OracleJRE-8-1.5.org.default.xml
similarity index 100%
rename from StigData/Processed/OracleJRE-8-1.5.org.default.xml
rename to source/StigData/Processed/OracleJRE-8-1.5.org.default.xml
diff --git a/StigData/Processed/OracleJRE-8-1.5.xml b/source/StigData/Processed/OracleJRE-8-1.5.xml
similarity index 100%
rename from StigData/Processed/OracleJRE-8-1.5.xml
rename to source/StigData/Processed/OracleJRE-8-1.5.xml
diff --git a/StigData/Processed/SqlServer-2012-Database-1.19.org.default.xml b/source/StigData/Processed/SqlServer-2012-Database-1.19.org.default.xml
similarity index 100%
rename from StigData/Processed/SqlServer-2012-Database-1.19.org.default.xml
rename to source/StigData/Processed/SqlServer-2012-Database-1.19.org.default.xml
diff --git a/StigData/Processed/SqlServer-2012-Database-1.19.xml b/source/StigData/Processed/SqlServer-2012-Database-1.19.xml
similarity index 100%
rename from StigData/Processed/SqlServer-2012-Database-1.19.xml
rename to source/StigData/Processed/SqlServer-2012-Database-1.19.xml
diff --git a/StigData/Processed/SqlServer-2012-Database-1.18.org.default.xml b/source/StigData/Processed/SqlServer-2012-Database-1.20.org.default.xml
similarity index 88%
rename from StigData/Processed/SqlServer-2012-Database-1.18.org.default.xml
rename to source/StigData/Processed/SqlServer-2012-Database-1.20.org.default.xml
index f4b278129..a9b2164e2 100644
--- a/StigData/Processed/SqlServer-2012-Database-1.18.org.default.xml
+++ b/source/StigData/Processed/SqlServer-2012-Database-1.20.org.default.xml
@@ -5,7 +5,7 @@
     Each setting in this file is linked by STIG ID and the valid range is in an
     associated comment.
 -->
-<OrganizationalSettings fullversion="1.18">
+<OrganizationalSettings fullversion="1.20">
   <!-- Ensure -->
   <OrganizationalSetting id="V-41407" VariableValue="" />
 </OrganizationalSettings>
diff --git a/StigData/Processed/SqlServer-2012-Database-1.18.xml b/source/StigData/Processed/SqlServer-2012-Database-1.20.xml
similarity index 96%
rename from StigData/Processed/SqlServer-2012-Database-1.18.xml
rename to source/StigData/Processed/SqlServer-2012-Database-1.20.xml
index 990cf6bd5..f759af03d 100644
--- a/StigData/Processed/SqlServer-2012-Database-1.18.xml
+++ b/source/StigData/Processed/SqlServer-2012-Database-1.20.xml
@@ -1,6 +1,6 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="MS_SQL_Server_2012_Database_Instance_STIG" description="The Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_SQL_Server_2012_Database_STIG_V1R18_Manual-xccdf.xml" releaseinfo="Release: 18 Benchmark Date: 25 Jan 2019" title="Microsoft SQL Server 2012 Database Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.18" created="7/29/2019">
-  <DocumentRule dscresourcemodule="None">
-    <Rule id="V-41389" severity="medium" conversionstatus="pass" title="SRG-APP-000006-DB-000183" dscresource="None">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="MS_SQL_Server_Database_2012" description="The Microsoft SQL Server 2012 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_SQL_Server_2012_Database_STIG_V1R20_Manual-xccdf.xml" releaseinfo="Release: 20 Benchmark Date: 16 Jan 2020" title="Microsoft SQL Server Database 2012 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.20" created="5/19/2020">
+  <DocumentRule dscresourcemodule="None">
+    <Rule id="V-41389" severity="medium" conversionstatus="pass" title="SRG-APP-000006-DB-000183" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
 
 These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies; reflect special dissemination, handling, or distribution instructions; or support other aspects of the information security policy.
@@ -9,19 +9,19 @@ One example includes marking data as classified or FOUO. These security attribut
 
 The sensitivity marking or labeling of stored data items promotes the correct handling and protection of data.  Without such notification, the user may unwittingly disclose sensitive data to unauthorized users.
 
-(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool. Spot check data and ensure the appropriate labels have been applied to stored data.   
+Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool. Spot check data and ensure the appropriate labels have been applied to stored data.
 
-If the labeling of sensitive data is required and is not being performed, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41391" severity="medium" conversionstatus="pass" title="SRG-APP-000007-DB-000184" dscresource="None">
+If the labeling of sensitive data is required and is not being performed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41391" severity="medium" conversionstatus="pass" title="SRG-APP-000007-DB-000184" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
 
 These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the application and are used to enable the implementation of access control and flow control policies; reflect special dissemination, handling, or distribution instructions; or support other aspects of the information security policy.
@@ -32,20 +32,20 @@ If the application does not maintain the data security attributes when it transm
 
 The sensitivity marking or labeling of data items promotes the correct handling and protection of data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users. Security labels must be correctly maintained throughout transmission.
 
-(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.  
+Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.
 
-If the labeling of sensitive information in process is not being performed, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41392" severity="medium" conversionstatus="pass" title="SRG-APP-000008-DB-000185" dscresource="None">
+If the labeling of sensitive information in process is not being performed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41392" severity="medium" conversionstatus="pass" title="SRG-APP-000008-DB-000185" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
 
 These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the application and are used to enable the implementation of access control and flow control policies; reflect special dissemination, handling, or distribution instructions; or support other aspects of the information security policy.
@@ -56,64 +56,64 @@ If the application does not maintain the data security attributes when it transm
 
 The sensitivity marking or labeling of data items promotes the correct handling and protection of data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users. Security labels must be correctly maintained throughout transmission.
 
-(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+(Earlier releases of this STIG suggested using the SQL Server Label Security Toolkit, from codeplex.com.  However, codeplex.com has been shut down, and it is unclear whether the Toolkit is still supported.  If the organization does have access to the Toolkit, it may still be used, provided the organization accepts responsibility for its support.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.  
+Obtain system configuration settings to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool.
 
-If the labeling of sensitive data in transmission is not being performed, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41393" severity="medium" conversionstatus="pass" title="SRG-APP-000012-DB-000192" dscresource="None">
+If the labeling of sensitive data in transmission is not being performed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41393" severity="medium" conversionstatus="pass" title="SRG-APP-000012-DB-000192" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
 
 These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies; reflect special dissemination, handling, or distribution instructions, or support other aspects of the information security policy.
 
 Examples of application security attributes are classified, FOUO, sensitive, etc.
 
-Throughout the course of normal usage, authorized users of applications that handle sensitive data will have the need to associate security attributes with information. Applications that maintain the binding of organization-defined security attributes to data must ensure authorized users can associate security attributes with information. For databases, this is accomplished via labeling.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Throughout the course of normal usage, authorized users of applications that handle sensitive data will have the need to associate security attributes with information. Applications that maintain the binding of organization-defined security attributes to data must ensure authorized users can associate security attributes with information. For databases, this is accomplished via labeling.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool. Determine how authorized users associate security information to data. If authorized users are not able to associate security labels to data, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41394" severity="medium" conversionstatus="pass" title="SRG-APP-000085-DB-000038" dscresource="None">
+Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL-developed means or via a third-party tool. Determine how authorized users associate security information to data. If authorized users are not able to associate security labels to data, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41394" severity="medium" conversionstatus="pass" title="SRG-APP-000085-DB-000038" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment.
 
 DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user-controlled file permissions. DAC models have the potential for the access controls to propagate without limit, resulting in unauthorized access to said objects.
 
 When applications provide a discretionary access control mechanism, the application must be able to limit the propagation of those access rights.
 
-The DBMS must ensure the recipient of object permissions possesses only the access intended. The database must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The DBMS must ensure the recipient of object permissions possesses only the access intended. The database must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check for rights propagation assignment to database permissions by running the following query:
 
 USE &lt;name of database being reviewed&gt;;
-SELECT * 
+SELECT *
 FROM sys.database_permissions
 WHERE state_desc = 'GRANT_WITH_GRANT_OPTION';
 
-If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41396" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000015" dscresource="None">
+If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41396" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000015" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
-Developers granted elevated database and/or operating system privileges on systems that support both development and production databases can affect the operation and/or security of the production database system. Operating system and database privileges assigned to developers on shared development and production systems must be restricted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Developers granted elevated database and/or operating system privileges on systems that support both development and production databases can affect the operation and/or security of the production database system. Operating system and database privileges assigned to developers on shared development and production systems must be restricted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Identify whether SQL Server contains both development and production databases from the system documentation.
 
 If SQL Server is not hosting both production and development databases, this is NA.
@@ -147,20 +147,20 @@ If any 'Server roles' are checked that grant production privileges, this is a fi
 
 Navigate from 'Server Roles' to 'Users mapped to the login'.
 
-If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be granting production privileges, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41399" severity="medium" conversionstatus="pass" title="SRG-APP-999999-DB-000209" dscresource="None">
+If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be granting production privileges, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41399" severity="medium" conversionstatus="pass" title="SRG-APP-999999-DB-000209" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with unauthorized SQL Server job submissions, it should be noted any unauthorized job submissions to SQL Server job/batch queues can potentially have significant effects on the overall security of the system.
 
 If SQL Server were to allow any user to make SQL Server job/batch queue submissions, then those submissions might lead to a compromise of system integrity and/or data. This requirement is contingent upon the SQL Server job/batch queue being review regularly for unauthorized submissions.
 
-Accordingly, only qualified and authorized individuals shall be allowed to obtain access to submit SQL Server jobs. Job/batch queue submissions must adhere to an organization-defined job submission process. 
+Accordingly, only qualified and authorized individuals shall be allowed to obtain access to submit SQL Server jobs. Job/batch queue submissions must adhere to an organization-defined job submission process.
 
-Unmanaged changes that occur to SQL Server job/batch queues can lead to a compromised system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unmanaged changes that occur to SQL Server job/batch queues can lead to a compromised system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check system documentation for procedures that are regularly implemented in an effort to detect unauthorized SQL Server job submissions.
 
 If procedures that are regularly implemented are not documented in the system documentation, this is a finding.
@@ -172,40 +172,40 @@ SELECT name
   FROM master.sys.procedures
  WHERE is_auto_executed = 1
 
-If any Stored Procedures listed are not documented as authorized, this is a finding.  
+If any Stored Procedures listed are not documented as authorized, this is a finding.
 
 Review the SQL Server job history by running the following query:
 
-SELECT *   FROM msdb.dbo.sysjobhistory 
+SELECT *   FROM msdb.dbo.sysjobhistory
 
 
-If any jobs listed are not documented as authorized, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41409" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
+If any jobs listed are not documented as authorized, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41409" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
-Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the list of components or optional features installed with SQL Server.
 If optional features or components are NOT installed, this is not a finding.
 
 If unused components or features of SQL Server are installed, then review the system documentation to verify unused components or features are documented and authorized.
 
-If any are not documented and authorized, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41417" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Data within the database is protected by use of encryption. The symmetric keys are critical for this process. If the symmetric keys were to be compromised the data could be disclosed to unauthorized personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If any are not documented and authorized, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41417" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Data within the database is protected by use of encryption. The symmetric keys are critical for this process. If the symmetric keys were to be compromised the data could be disclosed to unauthorized personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>In a query tool:
 USE &lt;database name&gt;;
 GO
@@ -223,23 +223,23 @@ If any keys are defined that are not documented in the System Security Plan, thi
 
 Review the System Security Plan to review the encryption mechanism specified for each symmetric key. If the method does not indicate use of certificates, this is a finding.
 
-If the certificate specified is not a DoD PKI certificate, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41421" severity="medium" conversionstatus="pass" title="SRG-APP-000243-DB-000128" dscresource="None">
+If the certificate specified is not a DoD PKI certificate, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41421" severity="medium" conversionstatus="pass" title="SRG-APP-000243-DB-000128" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.
 
-Data used for the development and testing of applications often involves copying data from production. It is important that specific procedures exist for this process, so copies of sensitive data are not misplaced or left in a temporary location without the proper controls.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Data used for the development and testing of applications often involves copying data from production. It is important that specific procedures exist for this process, so copies of sensitive data are not misplaced or left in a temporary location without the proper controls.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Verify there are proper procedures in place for the transfer of development/test data from production. Review any scripts or code that exists for the movement of production data to development/test and verify copies of production data are not left in unprotected locations.
 
 If there is no documented procedure for data movement from production to development/test, this is a finding.
 
-If data movement code that copies from production to development/test does exist and leaves any copies of production data in unprotected locations, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-60671" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000200" dscresource="None">
+If data movement code that copies from production to development/test does exist and leaves any copies of production data in unprotected locations, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-60671" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000200" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if misused, so their use must be tightly controlled.
 
 The SQL Server instance uses each database's TRUSTWORTHY property to guard against tampering that could enable unwarranted privilege escalation.  When TRUSTWORTHY is 0/False/Off, SQL Server prevents the database from accessing resources in other databases.  When TRUSTWORTHY is 1/True/On, SQL Server permits access to other databases (subject to other protections).  SQL Server sets TRUSTWORTHY OFF when it creates a new database.  SQL Server forces TRUSTWORTHY OFF, irrespective of its prior value, when an existing database is attached to it, to address the possibility that an adversary may have tampered with the database, introducing malicious code.  To set TRUSTWORTHY ON, an account with the [sysadmin] role must issue an ALTER DATABASE command.
@@ -252,38 +252,38 @@ Most of the other fixed server roles could be similarly abused.
 
 Therefore, TRUSTWORTHY must not be used on databases owned by logins that are members of the fixed server roles.  Further, if TRUSTWORTHY is to be used for any other database, the need must be documented and approved.
 
-The system database [msdb] is an exception: it is required to be TRUSTWORTHY.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The system database [msdb] is an exception: it is required to be TRUSTWORTHY.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the database is owned by an account that is directly or indirectly a member of a fixed (built-in) server role, this is not applicable (NA).
 
 Run the query:
 USE &lt;database name&gt;;
 GO
-SELECT 
-       DB_NAME()                  AS [Database], 
-       SUSER_SNAME(D.owner_sid)   AS [Database Owner], 
+SELECT
+       DB_NAME()                  AS [Database],
+       SUSER_SNAME(D.owner_sid)   AS [Database Owner],
        CASE WHEN D.is_trustworthy_on = 1 THEN 'ON' ELSE 'off' END
                                   AS [Trustworthy]
 FROM
-       sys.databases D 
+       sys.databases D
 WHERE
        D.[name] = DB_NAME()
 AND    DB_NAME() &lt;&gt; 'msdb'
 AND    D.is_trustworthy_on = 1;
 GO
-If the query returns a row indicating that the TRUSTWORTHY setting is OFF, or returns no rows, this is not a finding. 
-
-Review the system security plan to determine whether the need for TRUSTWORTHY is documented and approved.  If not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-70627" severity="low" conversionstatus="pass" title=" SRG-APP-000144-DB-000101" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;It is important for the appropriate personnel to be aware if the system is at risk of failing to record transaction log data.  The transaction log is the heart of a SQL Server database.  If it fails, processing will stop.  It must always have enough available storage space to cope with peak load.  Administrators must be warned about abnormally high space consumption soon enough to take corrective action before all space is used up.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the query returns a row indicating that the TRUSTWORTHY setting is OFF, or returns no rows, this is not a finding.
+
+Review the system security plan to determine whether the need for TRUSTWORTHY is documented and approved.  If not, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-70627" severity="low" conversionstatus="pass" title=" SRG-APP-000144-DB-000101" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;It is important for the appropriate personnel to be aware if the system is at risk of failing to record transaction log data.  The transaction log is the heart of a SQL Server database.  If it fails, processing will stop.  It must always have enough available storage space to cope with peak load.  Administrators must be warned about abnormally high space consumption soon enough to take corrective action before all space is used up.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation and/or organizational procedures to determine the threshold value for the storage used by the transaction log, above which staff must be alerted.  The threshold may be expressed as an absolute quantity, or a percentage of total available space.
 
 If this threshold has not been defined, this is a finding.
@@ -292,84 +292,84 @@ If monitoring software is in use, and has been configured to alert system and da
 
 If manual procedures exist for frequently checking the space used and alerting system and database administrators, and there is evidence that the procedures are adhered to, this is not a finding.
 
-Otherwise, this is a finding.</RawString>
-    </Rule>
-  </DocumentRule>
-  <ManualRule dscresourcemodule="None">
-    <Rule id="V-40911" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
+Otherwise, this is a finding.</RawString>
+    </Rule>
+  </DocumentRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-40911" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information.  Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use.
 
 User-generated data, as well as, application-specific configuration data, needs to be protected. Configurations and/or rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content are examples of system information likely requiring protection. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.
 
 If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.
 
-Protective measures include encryption, physical security of the facility where the storage devices reside, operating system file permissions, and organizational controls.  Each of these should be applied as necessary and appropriate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Protective measures include encryption, physical security of the facility where the storage devices reside, operating system file permissions, and organizational controls.  Each of these should be applied as necessary and appropriate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding.
 
-If the application owner and Authorizing Official have determined that encryption of data at rest is required, 
+If the application owner and Authorizing Official have determined that encryption of data at rest is required,
 ensure the data on secondary devices is encrypted. If full-disk encryption is being used, this is not a finding.
 
 If DBMS data encryption is required, ensure the data is encrypted before being put on the secondary device by executing:
 
-SELECT 
+SELECT
     d.name AS [Database Name],
-    CASE e.encryption_state 
-        WHEN 0 THEN 'No database encryption key present, no encryption' 
-        WHEN 1 THEN 'Unencrypted' 
-        WHEN 2 THEN 'Encryption in progress' 
-        WHEN 3 THEN 'Encrypted' 
-        WHEN 4 THEN 'Key change in progress' 
-        WHEN 5 THEN 'Decryption in progress' 
-        WHEN 6 THEN 'Protection change in progress' 
+    CASE e.encryption_state
+        WHEN 0 THEN 'No database encryption key present, no encryption'
+        WHEN 1 THEN 'Unencrypted'
+        WHEN 2 THEN 'Encryption in progress'
+        WHEN 3 THEN 'Encrypted'
+        WHEN 4 THEN 'Key change in progress'
+        WHEN 5 THEN 'Decryption in progress'
+        WHEN 6 THEN 'Protection change in progress'
     END AS [Encryption State]
-FROM sys.dm_database_encryption_keys e 
-RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name 
+FROM sys.dm_database_encryption_keys e
+RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name
 WHERE d.name NOT IN ('master','model','msdb')
 ORDER BY 1
 ;
 
 For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding.
 
-Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).  If not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41395" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000014" dscresource="None">
+Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).  If not, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41395" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000014" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
-Developers granted elevated database and/or operating system privileges on production databases can affect the operation and/or security of the database system. Operating system and database privileges assigned to developers on production systems should not be allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Developers granted elevated database and/or operating system privileges on production databases can affect the operation and/or security of the database system. Operating system and database privileges assigned to developers on production systems should not be allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check the list of SQL Server users against the list of developer accounts by running the following SQL Server query:
 
 SELECT name AS 'Account Name'
      , create_date AS 'Account Create Date'
      , LOGINPROPERTY(name, 'PasswordLastSetTime') AS 'Password Last Set on'
 FROM sys.server_principals
-WHERE NOT TYPE IN ('C', 'R', 'U') 
+WHERE NOT TYPE IN ('C', 'R', 'U')
 AND NOT name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##')
 AND sid &lt;&gt; CONVERT(VARBINARY(85), 0x01) -- no 'sa' account
 AND is_disabled &lt;&gt; 1
-ORDER BY name; 
+ORDER BY name;
 
-For each developer account found on a production machine, verify if the developer account can change or alter database objects or data in the production database. If any developer account can change or alter database objects or data in a production database, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41397" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000034" dscresource="None">
+For each developer account found on a production machine, verify if the developer account can change or alter database objects or data in the production database. If any developer account can change or alter database objects or data in a production database, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41397" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000034" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server must employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
 Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.
 
 SQL Server built-in administrative privileges, built-in server roles and built-in database roles must not be assigned directly to administrative user accounts (that is, server logins and database users). If administrative user accounts have direct access to administrative roles, this access must be removed, with the exception of administrative roles that the DBMS assigns to the special database principal [dbo], and will not allow to be altered.
 
-The built-in server role "sysadmin" is a partial exception. This cannot be granted to a user-defined role, only to a login account. Most (not necessarily all) database administrators will need to be members of sysadmin. Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable. The users who require such access must be documented and approved.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The built-in server role "sysadmin" is a partial exception. This cannot be granted to a user-defined role, only to a login account. Most (not necessarily all) database administrators will need to be members of sysadmin. Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable. The users who require such access must be documented and approved.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check administrative accounts for direct database role membership:
 
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'administrator account name'&gt; &gt;&gt; Properties &gt;&gt; User Mapping &gt;&gt; &lt;'highlight database'&gt; &gt;&gt; review 'Database role membership' for each database.
@@ -384,9 +384,9 @@ If any administration accounts have direct access to any 'Server roles' privileg
 
 The special database principal [dbo] is an exception.  It is mapped to the server login that is the database owner.  Some roles cannot be mapped to it or unmapped from it.  These role assignments are not a finding.
 
-The built-in server role "sysadmin" is a partial exception.  See the Vulnerability Discussion.</RawString>
-    </Rule>
-    <Rule id="V-41403" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
+The built-in server role "sysadmin" is a partial exception.  See the Vulnerability Discussion.</RawString>
+    </Rule>
+    <Rule id="V-41403" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant effects on the overall security of the system.
 
 If SQL Server were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.
@@ -395,19 +395,19 @@ This requirement is contingent upon the language in which the application is pro
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to SQL Server components for purposes of initiating changes, including upgrades and modifications.
 
-Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Functions, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Functions, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check the SQL Server configuration for a timed job that automatically checks all system and user-defined Functions for being modified by running the following SQL Server query:
 EXEC msdb.dbo.sp_help_job  @job_name = '&lt;enter . . . job name&gt;';
 
 (Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)
 
-If a timed job or some other method is not implemented to check for Functions being modified, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41404" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
+If a timed job or some other method is not implemented to check for Functions being modified, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41404" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant effects on the overall security of the system.
 
 If SQL Server were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.
@@ -416,19 +416,19 @@ This requirement is contingent upon the language in which the application is pro
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to SQL Server components for purposes of initiating changes, including upgrades and modifications.
 
-Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Triggers, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Triggers, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check the SQL Server configuration for the timed job that automatically checks all system and user-defined Triggers for being modified by running the following SQL Server query:
 EXEC msdb.dbo.sp_help_job  @job_name = '&lt;enter . . . job name&gt;';
 
 (Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)
 
-If such a job, or an alternative method of monitoring triggers for modification, does not exist, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41406" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
+If such a job, or an alternative method of monitoring triggers for modification, does not exist, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41406" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant effects on the overall security of the system.
 
 If SQL Server were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.
@@ -437,19 +437,19 @@ This requirement is contingent upon the language in which the application is pro
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to SQL Server components for purposes of initiating changes, including upgrades and modifications.
 
-Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Stored Procedures, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unmanaged changes that occur to the SQL Server software libraries or configuration, such as Stored Procedures, can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check for the existence of a job to monitor for changes to stored procedures:
 EXEC msdb.dbo.sp_help_job  @job_name = '&lt;enter . . . job name&gt;';
 
 (Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)
 
-If such a job, or an alternative method of monitoring stored procedures for modification, does not exist, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41411" severity="medium" conversionstatus="pass" title="SRG-APP-000188-DB-000121" dscresource="None">
+If such a job, or an alternative method of monitoring stored procedures for modification, does not exist, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41411" severity="medium" conversionstatus="pass" title="SRG-APP-000188-DB-000121" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and/or compromise.
 
 An organizational assessment of risk guides the selection of media and associated information contained on that media requiring restricted access. Organizations need to document, in policy and procedures, the media requiring restricted access, individuals authorized to access the media, and the specific measures taken to restrict access.
@@ -460,11 +460,11 @@ As part of a defense-in-depth strategy, the organization considers routinely enc
 
 The strength of mechanisms is commensurate with the classification and sensitivity of the information.
 
-Information at rest, when not encrypted, is open to compromise from attackers who have gained unauthorized access to the data files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Information at rest, when not encrypted, is open to compromise from attackers who have gained unauthorized access to the data files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review SQL Server's cryptographic settings to determine whether data stored in databases is encrypted according to organizational requirements and the system owner.
 
 If all of the data on SQL Server is unclassified and encryption of information is not required, this requirement is NA.
@@ -500,20 +500,20 @@ If any database that is supposed to have encryption enabled is not listed as suc
 
 If encryption is required by the information owner and an approved, NIST-certified cryptography is not used to encrypt stored sensitive information, this is a finding.
 
-Verify all sensitive information is encrypted: entire database, tables, columns and/or data elements, as required by the organization and the system owner.</RawString>
-    </Rule>
-    <Rule id="V-41412" severity="medium" conversionstatus="pass" title="SRG-APP-000196-DB-000140" dscresource="None">
+Verify all sensitive information is encrypted: entire database, tables, columns and/or data elements, as required by the organization and the system owner.</RawString>
+    </Rule>
+    <Rule id="V-41412" severity="medium" conversionstatus="pass" title="SRG-APP-000196-DB-000140" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data.
 
 Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
 
 Use of cryptography to provide confidentiality and non-repudiation is not effective unless strong methods are employed with its use. Many earlier encryption methods and modules have been broken and/or overtaken by increasing computing power. The NIST FIPS 140-2 cryptographic standards provide proven methods and strengths to employ cryptography effectively.
 
-Detailed information on the NIST Cryptographic Module Validation Program (CMVP) is available at the following website:  http://csrc.nist.gov/groups/STM/cmvp/index.html.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Detailed information on the NIST Cryptographic Module Validation Program (CMVP) is available at the following website:  http://csrc.nist.gov/groups/STM/cmvp/index.html.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If encryption is not required for this database, this is not a finding.
 
 Run the following SQL queries to review SQL Server's cryptographic settings for the database:
@@ -521,11 +521,11 @@ Run the following SQL queries to review SQL Server's cryptographic settings for
 USE &lt;database name&gt; ;
 IF NOT EXISTS
        (
-       SELECT 1 
+       SELECT 1
        FROM sys.dm_database_encryption_keys
        WHERE DB_NAME(database_id) = DB_NAME()
        )
-       SELECT 
+       SELECT
              DB_NAME() AS [Database Name],
              'No database encryption key present, no encryption' AS [Encryption State],
                      NULL AS [Algorithm],
@@ -533,36 +533,36 @@ IF NOT EXISTS
 ELSE
        SELECT
              DB_NAME(database_id) AS [Database Name],
-             CASE encryption_state 
-                   WHEN 0 THEN 'No database encryption key present, no encryption' 
-                   WHEN 1 THEN 'Unencrypted' 
-                   WHEN 2 THEN 'Encryption in progress' 
-                   WHEN 3 THEN 'Encrypted' 
-                   WHEN 4 THEN 'Key change in progress' 
-                   WHEN 5 THEN 'Decryption in progress' 
-                   WHEN 6 THEN 'Protection change in progress' 
+             CASE encryption_state
+                   WHEN 0 THEN 'No database encryption key present, no encryption'
+                   WHEN 1 THEN 'Unencrypted'
+                   WHEN 2 THEN 'Encryption in progress'
+                   WHEN 3 THEN 'Encrypted'
+                   WHEN 4 THEN 'Key change in progress'
+                   WHEN 5 THEN 'Decryption in progress'
+                   WHEN 6 THEN 'Protection change in progress'
              END AS [Encryption State],
                      key_algorithm AS [Algorithm],
                      key_length AS [Key Length]
        FROM sys.dm_database_encryption_keys
        WHERE DB_NAME(database_id) = DB_NAME()
 
-SELECT DB_NAME() AS [Database], name, algorithm_desc 
-FROM sys.symmetric_keys 
+SELECT DB_NAME() AS [Database], name, algorithm_desc
+FROM sys.symmetric_keys
 ORDER BY name, algorithm_desc;
 
 Note:  The acceptable algorithms are:  "AES 128", "AES 192", "AES 256" and "Triple DES".
 
 If SQL Server cryptographic algorithms are not listed or are found not to be compliant with applicable federal laws, Executive Orders, directives, policies, regulations, standards and guidance, this is a finding.
 
-If the encryption state indicates that the database is unencrypted, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41415" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;When not encrypted by the Service Master Key, system administrators or application administrators may access and use the Database Master Key to view sensitive data that they are not authorized to view. Where alternate encryption means are not feasible, encryption by the Service Master Key may be necessary. To help protect sensitive data from unauthorized access by DBAs, mitigations may be in order. Mitigations may include automatic alerts or other audit events when the Database Master Key is accessed outside of the application or by a DBA account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If the encryption state indicates that the database is unencrypted, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41415" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When not encrypted by the Service Master Key, system administrators or application administrators may access and use the Database Master Key to view sensitive data that they are not authorized to view. Where alternate encryption means are not feasible, encryption by the Service Master Key may be necessary. To help protect sensitive data from unauthorized access by DBAs, mitigations may be in order. Mitigations may include automatic alerts or other audit events when the Database Master Key is accessed outside of the application or by a DBA account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>From the query prompt:
 SELECT name
 FROM [master].sys.databases
@@ -575,31 +575,31 @@ Master Key using the Service Master Key is acceptable and approved by the Inform
 
 If approved and additional protections are required, then verify the additional requirements are in place in accordance with the System Security Plan. These may include additional auditing on access of the Database Master Key with alerts or other automated monitoring.
 
-If the additional requirements are not in place, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41416" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
+If the additional requirements are not in place, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41416" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Storage of the Database Master Key password in a database credential allows decryption of sensitive data by privileged users who may not have a need-to-know requirement to access the
-data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>From the query prompt:
 SELECT COUNT(credential_id)
 FROM [master].sys.master_key_passwords
 
-If count is not 0, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41420" severity="medium" conversionstatus="pass" title="SRG-APP-000232-DB-000155" dscresource="None">
+If count is not 0, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41420" severity="medium" conversionstatus="pass" title="SRG-APP-000232-DB-000155" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. If the data is not encrypted, it is subject to compromise and unauthorized disclosure.
 
 Note:  the system databases (master, msdb, model, resource and tempdb) cannot be encrypted.
 
-The decision whether to employ cryptography is the responsibility of the information owner/steward, who exercises discretion within the framework of applicable rules, policies and law.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The decision whether to employ cryptography is the responsibility of the information owner/steward, who exercises discretion within the framework of applicable rules, policies and law.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If this is a system database (master, msdb, resource, tempdb or model), this is not applicable (NA).
 
 If the application owner and authorizing official have determined that the database does not require encryption, this is not a finding.
@@ -608,32 +608,32 @@ Ensure the data is encrypted by executing:
 USE &lt;database name&gt;;
 IF NOT EXISTS
     (
-    SELECT 1 
+    SELECT 1
     FROM sys.dm_database_encryption_keys
     WHERE DB_NAME(database_id) = DB_NAME()
     )
-    SELECT 
+    SELECT
         DB_NAME() AS [Database Name],
         'No database encryption key present, no encryption' AS [Encryption State]
 ELSE
     SELECT
         DB_NAME(database_id)  AS [Database Name],
-        CASE encryption_state 
-            WHEN 0 THEN 'No database encryption key present, no encryption' 
-            WHEN 1 THEN 'Unencrypted' 
-            WHEN 2 THEN 'Encryption in progress' 
-            WHEN 3 THEN 'Encrypted' 
-            WHEN 4 THEN 'Key change in progress' 
-            WHEN 5 THEN 'Decryption in progress' 
-            WHEN 6 THEN 'Protection change in progress' 
-        END AS [Encryption State] 
+        CASE encryption_state
+            WHEN 0 THEN 'No database encryption key present, no encryption'
+            WHEN 1 THEN 'Unencrypted'
+            WHEN 2 THEN 'Encryption in progress'
+            WHEN 3 THEN 'Encrypted'
+            WHEN 4 THEN 'Key change in progress'
+            WHEN 5 THEN 'Decryption in progress'
+            WHEN 6 THEN 'Protection change in progress'
+        END AS [Encryption State]
     FROM sys.dm_database_encryption_keys
     WHERE DB_NAME(database_id) = DB_NAME()
 ;
 
-For each user database, ensure that encryption is in effect.  If not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41422" severity="medium" conversionstatus="pass" title="SRG-APP-000245-DB-000132" dscresource="None">
+For each user database, ensure that encryption is in effect.  If not, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41422" severity="medium" conversionstatus="pass" title="SRG-APP-000245-DB-000132" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Application management includes the ability to control the number of users and user sessions utilizing an application. Limiting the number of allowed users, and sessions per user, is helpful in limiting risks related to DoS attacks.
 
 This requirement addresses concurrent session control for a single information system account and does not address concurrent sessions by a single user via multiple system accounts.
@@ -642,11 +642,11 @@ This requirement may be met via the application or by utilizing information syst
 
 The organization will need to define the maximum number of concurrent sessions for SQL Server accounts by account type, by account, or a combination thereof and SQL Server shall enforce this requirement.
 
-Unlimited concurrent connections to SQL Server could allow a successful DoS attack by exhausting connection resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unlimited concurrent connections to SQL Server could allow a successful DoS attack by exhausting connection resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check SQL Server settings for the number of concurrent Check SQL Server settings for the number of concurrent sessions by running the following script:
 
 USE MASTER
@@ -658,28 +658,28 @@ EXEC sys.sp_configure N'user connections'
 EXEC sys.sp_configure N'show advanced options', N'0'  RECONFIGURE WITH OVERRIDE
 GO
 
-If SQL Server settings for concurrent sessions is not lower than or equal to the organization-defined maximum number of sessions, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41424" severity="medium" conversionstatus="pass" title="SRG-APP-000251-DB-000160" dscresource="None">
+If SQL Server settings for concurrent sessions is not lower than or equal to the organization-defined maximum number of sessions, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41424" severity="medium" conversionstatus="pass" title="SRG-APP-000251-DB-000160" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Invalid user input occurs when a user inserts data or characters into an application’s data entry fields and the application is unprepared to process that data. This results in unanticipated application behavior potentially leading to an application or information system compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application.
 
 SQL Server needs to validate the data user’s attempt to input to the application for processing. Rules for checking the valid syntax and semantics of information system inputs (e.g., character set, length, numerical range, acceptable values) are in place to verify inputs match specified definitions for format and content. Inputs passed to interpreters are prescreened to prevent the content from being unintentionally interpreted as commands.
 
 A poorly designed database system can have many problems. A common issue with these types of systems is the missed opportunity to use constraints.
 
-While this matter is of great importance to the secure operation of database management systems, the DBA in a typical installation will communicate with the application development/support staff to obtain assurance that this requirement is met.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+While this matter is of great importance to the secure operation of database management systems, the DBA in a typical installation will communicate with the application development/support staff to obtain assurance that this requirement is met.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review SQL Server field definitions, constraints, and foreign keys to determine whether or not data being input into the database is valid.
 If field definitions are not reflective of the data, this is a finding.
 
 If column data types are not assigned correctly where required within the database, this is a finding.
 
-If columns do not contain reasonable constraints based on column use, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-60781" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000200" dscresource="None">
+If columns do not contain reasonable constraints based on column use, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-60781" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000200" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if misused, so their use must be tightly controlled.
 
 The SQL Server instance uses each database's TRUSTWORTHY property to guard against tampering that could enable unwarranted privilege escalation.  When TRUSTWORTHY is 0/False/Off, SQL Server prevents the database from accessing resources in other databases.  When TRUSTWORTHY is 1/True/On, SQL Server permits access to other databases (subject to other protections).  SQL Server sets TRUSTWORTHY OFF when it creates a new database.  SQL Server forces TRUSTWORTHY OFF, irrespective of its prior value, when an existing database is attached to it, to address the possibility that an adversary may have tampered with the database, introducing malicious code.  To set TRUSTWORTHY ON, an account with the [sysadmin] role must issue an ALTER DATABASE command.
@@ -692,11 +692,11 @@ Most of the other fixed server roles could be similarly abused.
 
 Therefore, TRUSTWORTHY must not be used on databases owned by logins that are members of the fixed server roles.  Further, if TRUSTWORTHY is to be used for any other database, the need must be documented and approved.
 
-The system database [msdb] is an exception: it is required to be TRUSTWORTHY.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The system database [msdb] is an exception: it is required to be TRUSTWORTHY.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>USE &lt;database name&gt;;
 GO
 WITH FixedServerRoles(RoleName) AS
@@ -710,53 +710,53 @@ WITH FixedServerRoles(RoleName) AS
     UNION SELECT 'dbcreator'
     UNION SELECT 'bulkadmin'
 )
-SELECT 
-    DB_NAME() AS [Database], 
-    SUSER_SNAME(D.owner_sid) AS [Database Owner], 
+SELECT
+    DB_NAME() AS [Database],
+    SUSER_SNAME(D.owner_sid) AS [Database Owner],
     F.RoleName AS [Fixed Server Role],
     CASE WHEN D.is_trustworthy_on = 1 THEN 'ON' ELSE 'off' END
-        AS [Trustworthy]    
+        AS [Trustworthy]
 FROM
     FixedServerRoles F
     INNER JOIN sys.databases D ON D.Name = DB_NAME()
-WHERE 
+WHERE
     IS_SRVROLEMEMBER(F.RoleName, SUSER_SNAME(D.owner_sid)) = 1
 AND    DB_NAME()  &lt;&gt;  'msdb'
 AND    D.is_trustworthy_on = 1;
 GO
-If the query returns any rows, this is a finding.  </RawString>
-    </Rule>
-  </ManualRule>
-  <SqlScriptQueryRule dscresourcemodule="SqlServerDsc">
-    <Rule id="V-41402" severity="medium" conversionstatus="pass" title="SRG-APP-000089-DB-000064" dscresource="SqlScriptQuery">
+If the query returns any rows, this is a finding.  </RawString>
+    </Rule>
+  </ManualRule>
+  <SqlScriptQueryRule dscresourcemodule="SqlServerDsc">
+    <Rule id="V-41402" severity="medium" conversionstatus="pass" title="SRG-APP-000089-DB-000064" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;Audit records can be generated from various components within the information system (e.g., network interface, hard disk, modem, etc.). From an application perspective, certain specific application functionalities may be audited as well.
 
 The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.  Examples are auditable events, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
-Organizations define which application components shall provide auditable events. 
+Organizations define which application components shall provide auditable events.
 
-The DBMS must provide auditing for the list of events defined by the organization or risk negatively impacting forensic investigations into malicious behavior in the information system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The DBMS must provide auditing for the list of events defined by the organization or risk negatively impacting forensic investigations into malicious behavior in the information system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -764,25 +764,25 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41407" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000200" dscresource="SqlScriptQuery">
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41407" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000200" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;SQL Server database ownership is a higher level privilege that grants full rights to everything in that database, including the right to grant privileges to others. SQL Server requires that the owner of a database object be a user, and only one user can be the assigned owner of a database object. This tends to minimize the risk that multiple users could gain unauthorized access, except the one individual who is the owner.
 
-Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Unmanaged or uncontrolled ownership of databases can lead to unauthorized granting of privileges and database alterations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>select suser_sname(owner_sid) AS 'Owner' from sys.databases where name = $(Database)</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Unmanaged or uncontrolled ownership of databases can lead to unauthorized granting of privileges and database alterations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>select suser_sname(owner_sid) AS 'Owner' from sys.databases where name = $(Database)</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to identify SQL Server accounts authorized to own database objects.
 
 If the SQL Server database ownership list does not exist or needs to be updated, this is a finding.
@@ -792,11 +792,11 @@ SELECT name AS 'Database name'
      , SUSER_SNAME(owner_sid) AS 'Database Owner'
      , state_desc AS 'Database state'
   FROM sys.databases
-</RawString>
-      <SetScript>ALTER AUTHORIZATION ON DATABASE::$(Database) to $(DatabaseOwner)</SetScript>
-      <TestScript>SELECT suser_sname(owner_sid) AS 'Owner' FROM sys.databases WHERE name = N'$(Database)' and suser_sname(owner_sid) != N'$(DatabaseOwner)';</TestScript>
-      <Variable>DatabaseOwner={0}</Variable>
-      <VariableValue />
-    </Rule>
-  </SqlScriptQueryRule>
+</RawString>
+      <SetScript>ALTER AUTHORIZATION ON DATABASE::$(Database) to $(DatabaseOwner)</SetScript>
+      <TestScript>SELECT suser_sname(owner_sid) AS 'Owner' FROM sys.databases WHERE name = N'$(Database)' and suser_sname(owner_sid) != N'$(DatabaseOwner)';</TestScript>
+      <Variable>DatabaseOwner={0}</Variable>
+      <VariableValue />
+    </Rule>
+  </SqlScriptQueryRule>
 </DISASTIG>
diff --git a/StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml b/source/StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml
similarity index 100%
rename from StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml
rename to source/StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml
diff --git a/StigData/Processed/SqlServer-2012-Instance-1.19.xml b/source/StigData/Processed/SqlServer-2012-Instance-1.19.xml
similarity index 100%
rename from StigData/Processed/SqlServer-2012-Instance-1.19.xml
rename to source/StigData/Processed/SqlServer-2012-Instance-1.19.xml
diff --git a/StigData/Processed/SqlServer-2012-Instance-1.17.org.default.xml b/source/StigData/Processed/SqlServer-2012-Instance-1.20.org.default.xml
similarity index 92%
rename from StigData/Processed/SqlServer-2012-Instance-1.17.org.default.xml
rename to source/StigData/Processed/SqlServer-2012-Instance-1.20.org.default.xml
index 4f59dabea..98fa6dc26 100644
--- a/StigData/Processed/SqlServer-2012-Instance-1.17.org.default.xml
+++ b/source/StigData/Processed/SqlServer-2012-Instance-1.20.org.default.xml
@@ -1,21 +1,21 @@
-<!--
-    The organizational settings file is used to define the local organizations
-    preferred setting within an allowed range of the STIG.
-
-    Each setting in this file is linked by STIG ID and the valid range is in an
-    associated comment.
--->
-<OrganizationalSettings fullversion="1.17">
-  <!-- Ensure the correct path is specified and does NOT conflict with RuleId V-69169-->
-  <OrganizationalSetting id="V-40950" Path="" />
-  <!-- Ensure -->
-  <OrganizationalSetting id="V-41022" VariableValue="" />
-  <!-- Ensure -->
-  <OrganizationalSetting id="V-41024" VariableValue="" />
-  <!-- Ensure -->
-  <OrganizationalSetting id="V-41037" VariableValue="" />
-  <!-- Ensure -->
-  <OrganizationalSetting id="V-41251" VariableValue="" />
-  <!-- Ensure the correct path is specified and does NOT conflict with RuleId V-40950-->
-  <OrganizationalSetting id="V-69169" Path="" />
-</OrganizationalSettings>
+<!--
+    The organizational settings file is used to define the local organizations
+    preferred setting within an allowed range of the STIG.
+
+    Each setting in this file is linked by STIG ID and the valid range is in an
+    associated comment.
+-->
+<OrganizationalSettings fullversion="1.20">
+  <!-- Ensure the correct path is specified and does NOT conflict with RuleId V-69169-->
+  <OrganizationalSetting id="V-40950" Path="" />
+  <!-- Ensure -->
+  <OrganizationalSetting id="V-41022" VariableValue="" />
+  <!-- Ensure -->
+  <OrganizationalSetting id="V-41024" VariableValue="" />
+  <!-- Ensure -->
+  <OrganizationalSetting id="V-41037" VariableValue="" />
+  <!-- Ensure -->
+  <OrganizationalSetting id="V-41251" VariableValue="" />
+  <!-- Ensure the correct path is specified and does NOT conflict with RuleId V-40950-->
+  <OrganizationalSetting id="V-69169" Path="" />
+</OrganizationalSettings>
diff --git a/StigData/Processed/SqlServer-2012-Instance-1.17.xml b/source/StigData/Processed/SqlServer-2012-Instance-1.20.xml
similarity index 88%
rename from StigData/Processed/SqlServer-2012-Instance-1.17.xml
rename to source/StigData/Processed/SqlServer-2012-Instance-1.20.xml
index e8149f8b5..da4faec7f 100644
--- a/StigData/Processed/SqlServer-2012-Instance-1.17.xml
+++ b/source/StigData/Processed/SqlServer-2012-Instance-1.20.xml
@@ -1,13 +1,13 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Microsoft_SQL_Server_2012_Database_Instance_Security_Technical_Implementation_Guide" description="The Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.xml" releaseinfo="Release: 17 Benchmark Date: 27 Apr 2018" title="Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.17" created="11/21/2019">
-  <DocumentRule dscresourcemodule="None">
-    <Rule id="V-40907" severity="high" conversionstatus="pass" title="SRG-APP-000264-DB-000136" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel. 
-
-Information in transmission is particularly vulnerable to attack. If the DBMS does not employ cryptographic mechanisms preventing unauthorized disclosure of information during transit, the information may be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="MS_SQL_Server_Instance_2012" description="The Microsoft SQL Server 2012 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_SQL_Server_Instance_2012_V1R20_Manual-xccdf.xml" releaseinfo="Release: 20 Benchmark Date: 16 Jan 2020" title="Microsoft SQL Server Instance 2012 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.20" created="5/29/2020">
+  <DocumentRule dscresourcemodule="None">
+    <Rule id="V-40907" severity="high" conversionstatus="pass" title="SRG-APP-000264-DB-000136" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel.
+
+Information in transmission is particularly vulnerable to attack. If the DBMS does not employ cryptographic mechanisms preventing unauthorized disclosure of information during transit, the information may be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the DBMS exists in the unclassified environment, and data transmission does not cross the boundary between the NIPRNet and the wider Internet, and the application owner and authorizing official have determined that encryption is not required, this is not a finding.
 
 Check SQL Server and network settings to determine whether cryptographic mechanisms are used to prevent the unauthorized disclosure of information during transmission. If not, this is a finding.
@@ -29,72 +29,72 @@ If Force Encryption is set, a DoD Certificate is not utilized, and a physical en
 
 If any of the preceding requirements is not met, this is a finding.
 
-If Force Encryption is set to "NO" or a DoD Certificate is not utilized, and physical encryption measures are not utilized, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40908" severity="medium" conversionstatus="pass" title="SRG-APP-000248-DB-000135" dscresource="None">
+If Force Encryption is set to "NO" or a DoD Certificate is not utilized, and physical encryption measures are not utilized, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40908" severity="medium" conversionstatus="pass" title="SRG-APP-000248-DB-000135" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server has a feature called 'Availability Group' which provides automatic failover from a primary SQL Server to a secondary server. This concept is not new, but because SQL Server does warn that if the secondary SQL Server is not dedicated 100% to being a backup server, that "resource exhaustion" may be an issue if there is some load balancing going on.
 
 If the primary SQL Server has a backup/secondary server that is dedicated 100% to the primary server's process, this is not a finding. If, however, the processing of the primary SQL Server is loaded to a secondary server that is already partly resourced to process something other than that of the primary SQL Server responsibility, then there can be load balancing issues.
 
-Load balancing for the purpose of sharing a secondary/backup SQL Server is often done to share and save on resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Load balancing for the purpose of sharing a secondary/backup SQL Server is often done to share and save on resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If Database Availability Groups are not being used, this is not applicable (NA).
 
-Check the system documentation and check with the administrator regarding processing resources of the backup/secondary SQL Server. 
+Check the system documentation and check with the administrator regarding processing resources of the backup/secondary SQL Server.
 
 If the primary SQL Server has a backup/secondary server that is dedicated 100% to the primary server's processing, this is not a finding.
 
 If the secondary/backup SQL Server is already partly resourced to process something other than that of the primary SQL Server processing, then determine what resources would be required for the secondary/backup SQL Server.
 
-If the secondary/backup SQL Server is determined to not have enough processing resources to fulfill the function of the primary server's SQL Server process, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40909" severity="low" conversionstatus="pass" title="SRG-APP-000248-DB-000135" dscresource="None">
+If the secondary/backup SQL Server is determined to not have enough processing resources to fulfill the function of the primary server's SQL Server process, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40909" severity="low" conversionstatus="pass" title="SRG-APP-000248-DB-000135" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Priority protection helps prevent a lower-priority process from delaying or interfering with the information system servicing any higher-priority process. This control does not apply to components in the information system for which there is only a single user/role. The application must limit the use of resources by priority.
 
 SQL Server often runs queries for multiple users at the same time. If lower priority processes are utilizing a disproportionately high amount of database resources, this can severely impact higher priority processes.
 
-Even if SQL Server's utilization is very small and there may seem to be no need to priority protection, often resources grow exponentially and must be implemented as part of an initial deployment.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Even if SQL Server's utilization is very small and there may seem to be no need to priority protection, often resources grow exponentially and must be implemented as part of an initial deployment.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation and determine if one type or more of SQL Server users has a business need for priority usage over other types of users. The need for prioritization most frequently occurs when SQL Server resources are shared between two or more applications or systems where the number of users on more than one system is small or non-existent. This needs to be the case, because SQL Server limits resource based on user accounts and not what process is running.
 
-If SQL Server has users that are determined to run significantly high priority processes than other users and the SQL Server "Resource Governor" is not being implemented, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40912" severity="low" conversionstatus="pass" title="SRG-APP-000203-DB-000146" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;When data is exchanged between information systems, the security attributes associated with said data need to be maintained.  
+If SQL Server has users that are determined to run significantly high priority processes than other users and the SQL Server "Resource Governor" is not being implemented, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40912" severity="low" conversionstatus="pass" title="SRG-APP-000203-DB-000146" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When data is exchanged between information systems, the security attributes associated with said data need to be maintained.
 
-Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. 
+Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy.
 
-Security attributes may be explicitly or implicitly associated with the information contained within the information system. 
+Security attributes may be explicitly or implicitly associated with the information contained within the information system.
 
-If database security labels are not maintained as information moves between systems, handling instructions can be lost and data can be accidentally distributed to unauthorized individuals.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If database security labels are not maintained as information moves between systems, handling instructions can be lost and data can be accidentally distributed to unauthorized individuals.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines.
 
 If the labeling of sensitive data is not required, this is NA.
 
-Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL developed means or via a third-party tool. Check to ensure that labels are being associated to data when information is being exchanged between systems.   
+Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL developed means or via a third-party tool. Check to ensure that labels are being associated to data when information is being exchanged between systems.
 
-If the labeling is not being associated to data when exchanging data between systems, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40913" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
+If the labeling is not being associated to data when exchanging data between systems, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40913" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it.
 
 The user account associated with public access must not have access to the OS or SQL Server configuration information, include read access to schema information.
 
-This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 Obtain from the DBA or system documentation the list of publicly available data within SQL Server and the role names that assign read-only access to that public data.
@@ -108,20 +108,20 @@ Determine if SQL Server is granting more than read access to the publicly availa
 
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'user account'&gt; &gt;&gt; Properties &gt;&gt; Server Roles.
 
-If any 'Server Roles' are marked that grant more than read access to the publicly available information, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40914" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
+If any 'Server Roles' are marked that grant more than read access to the publicly available information, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40914" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it.
 
 The user account  associated with public access must not have access to the OS or SQL Server configuration information, include read access to schema information. This access includes, but is not limited to, SQL Server 'User Mapping' assignments.
 
 SQL Server access to any of the three system databases (master, model, or msdb) is restricted from the publicly available user account, because this would grant more than read-only access to public information. Of the existing user-defined databases, privileges must be checked to allow only read access to publically available data.
 
-This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 Obtain from the DBA or system documentation the list of publicly available data within SQL Server.
@@ -135,9 +135,9 @@ Determine if SQL Server is granting more than read access to the publicly availa
 
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'user account'&gt; &gt;&gt; Properties &gt;&gt; User Mapping.
 
-If any of the three system databases are checked (indicating a granted privilege): master, model, or msdb, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40916" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
+If any of the three system databases are checked (indicating a granted privilege): master, model, or msdb, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40916" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls.
 
 SQL Server must be configured to contain publicly available information. Though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it. A publicly available user account must not have access to the OS or SQL Server configuration information, including read access to schema information. Determine what publicly available user account is being used to access SQL Server and validate that the publicly available user account only has read access to the public data and nothing else. This read-only access does not include SQL Server 'Securables' assignments.
@@ -146,25 +146,25 @@ SQL Server 'Securables' assignments grant the assignee privileges that are beyon
 
 Likely the only 'Server roles' assignment for the publicly available user account would be 'public'. The only other 'Server roles' that could be authorized as read-only is a user-defined 'Server role'. It is more likely that read-only access is set up at the user database instance in role(s) specifically set up for this purpose. Assignment to the user database instances are made in the 'User Mapping' highlight within a user's properties.
 
-This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 If SQL Server supports an application collecting information from the public, this is NA.
 
 Obtain from the DBA or system documentation the list of publicly available data within SQL Server.
-Obtain the publicly available user account(s) being used to access SQL Server. 
+Obtain the publicly available user account(s) being used to access SQL Server.
 
 Determine if SQL Server is granting more than read access to the publicly available information through SQL Server 'Securables'.
 
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins &gt;&gt; right click &lt;'user account'&gt; &gt;&gt; Properties &gt;&gt; Securables.
 
-If any 'Securables' are listed, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40917" severity="high" conversionstatus="pass" title="SRG-APP-000196-DB-000141" dscresource="None">
+If any 'Securables' are listed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40917" severity="high" conversionstatus="pass" title="SRG-APP-000196-DB-000141" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data.
 
 Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
@@ -177,11 +177,11 @@ Developed using established NSA business processes and containing NSA approved a
 
 NSA-approved cryptography is required to be used for classified information system processing.
 
-See FIPS Publication 140-2 and related documents for guidance on approved encryption techniques and certified encryption modules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+See FIPS Publication 140-2 and related documents for guidance on approved encryption techniques and certified encryption modules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the system exists in the non-classified environment, this is NA.
 
 For each database under the SQL Server instance, review the system documentation to determine whether the database holds classified or sensitive information. If it does not, this is not a finding.
@@ -207,20 +207,20 @@ WHERE d.name NOT IN ('master','model','msdb')
 ORDER BY 1
 ;
 For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding.
-</RawString>
-    </Rule>
-    <Rule id="V-40918" severity="medium" conversionstatus="pass" title="SRG-APP-000198-DB-000143" dscresource="None">
+</RawString>
+    </Rule>
+    <Rule id="V-40918" severity="medium" conversionstatus="pass" title="SRG-APP-000198-DB-000143" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
 
 NSA has developed Type 1 algorithms for protecting classified information. The Committee on National Security Systems (CNSS) National Information Assurance Glossary (CNSS Instruction No. 4009) defines Type 1 products as:
 “Cryptographic equipment, assembly or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed.
 Developed using established NSA business processes and containing NSA approved algorithms are used to protect systems requiring the most stringent protection mechanisms.”
 
-NSA-approved cryptography is required to be used for classified information system processing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+NSA-approved cryptography is required to be used for classified information system processing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to determine whether cryptography for classified or sensitive information is required by the information owner.
 
 If the system documentation does not specify the type of information hosted on SQL Server: classified, sensitive and/or unclassified, this is a finding.
@@ -254,27 +254,27 @@ IF @nCount &gt; 0
 If any items list showing an uncertified NIST FIPS 140-2 algorithm type, this is a finding.
 If an audit record is not generated for unauthorized access to the asymmetric key, this is a finding.
 
-Detailed information on the NIST Cryptographic Module Validation Program (CMVP) is available at the following website:  http://csrc.nist.gov/groups/STM/cmvp/index.html.</RawString>
-    </Rule>
-    <Rule id="V-40919" severity="medium" conversionstatus="pass" title="SRG-APP-000180-DB-000115" dscresource="None">
+Detailed information on the NIST Cryptographic Module Validation Program (CMVP) is available at the following website:  http://csrc.nist.gov/groups/STM/cmvp/index.html.</RawString>
+    </Rule>
+    <Rule id="V-40919" severity="medium" conversionstatus="pass" title="SRG-APP-000180-DB-000115" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations).
 
 Non-organizational users shall be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server.
 
-This may be accomplished by a code embedded within the userid, or via a flag or code columns in a table of users, or by some other means. In any case, the user must be individually identified to, and within, SQL Server via a mapping to an individual account and not mapping to a shared account. 
+This may be accomplished by a code embedded within the userid, or via a flag or code columns in a table of users, or by some other means. In any case, the user must be individually identified to, and within, SQL Server via a mapping to an individual account and not mapping to a shared account.
 
 Accordingly, a risk assessment is used in determining the authentication needs of the organization.
 
-Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, and other organizations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, and other organizations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review documentation, SQL Server settings and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system.
 
-If non-organizational users are not uniquely identified and authenticated, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40927" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000098" dscresource="None">
+If non-organizational users are not uniquely identified and authenticated, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40927" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000098" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server backups are a critical step in maintaining data assurance and availability.
 
 User-level information is data generated by information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user generated data is backed up at a defined frequency. This includes data stored on file systems, within databases or within any other storage media.
@@ -285,11 +285,11 @@ Lost or compromised SQL Server backup or restoration files may lead to not only
 
 SQL Server can maintain local copies of critical control files to provide transparent or easy recovery from hard disk loss or other interruptions to database operation.
 
-Backup files, both local to the SQL Server machine and not local to the machine, need the same protections against unauthorized access when stored on backup media as when online and actively in use by the database system. In addition, the backup media needs to be protected against physical loss.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Backup files, both local to the SQL Server machine and not local to the machine, need the same protections against unauthorized access when stored on backup media as when online and actively in use by the database system. In addition, the backup media needs to be protected against physical loss.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain authorized access list for backup and restoration procedures from system documentation.
 
 If documented procedures are insufficient to show or describe authorized personnel, this is a finding.
@@ -300,9 +300,9 @@ Review access protections and procedures for offline backup and restoration file
 
 If backup or restoration files are subject to unauthorized access, this is a finding.
 
-It may be necessary to review backup and restoration procedures to determine ownership and access during all phases of backup and recovery. In addition to physical and host system protections, consider other methods including encryption protection of the files.</RawString>
-    </Rule>
-    <Rule id="V-40928" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000097" dscresource="None">
+It may be necessary to review backup and restoration procedures to determine ownership and access during all phases of backup and recovery. In addition to physical and host system protections, consider other methods including encryption protection of the files.</RawString>
+    </Rule>
+    <Rule id="V-40928" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000097" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server backups are a critical step in maintaining data assurance and availability.
 
 User-level information is data generated by the information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user-generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media.
@@ -311,11 +311,11 @@ Applications performing backups must be capable of backing up user-level informa
 
 Problems with backup procedures or backup media may not be discovered until after a recovery is needed. Testing and verification of procedures provides the opportunity to discover oversights, conflicts, or other issues in the backup procedures or use of media designed to be used.
 
-Part of an overall backup and recovery methodology includes regular recovery testing. This is very important and helps to expose any issue in the recovery process (e.g., hardware, procedures, etc.).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Part of an overall backup and recovery methodology includes regular recovery testing. This is very important and helps to expose any issue in the recovery process (e.g., hardware, procedures, etc.).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review SQL Server's documented testing and recovery procedures that exist in the system documentation.
 
 If the testing or recovery procedures are not documented in the system documentation, this is a finding.
@@ -324,59 +324,59 @@ If the documented testing or recovery procedures are not sufficient to test or r
 
 Review evidence of implementation of testing and verification procedures by reviewing logs from backup and recovery implementation. Logs may be in electronic form or hardcopy, and may include email or other notification.
 
-If the system recovery testing has not been implemented and documented, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40929" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000096" dscresource="None">
+If the system recovery testing has not been implemented and documented, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40929" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000096" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server backup is a critical step in maintaining data assurance and availability.
 
 User-level information is data generated by the information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user-generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media.
 
 Applications performing backups must be configured to back up user-level information per the DoD-defined frequency.
 
-SQL Server Database backups provide the required means to restore databases after compromise or loss. Backups help reduce the vulnerability to unauthorized access or hardware loss.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+SQL Server Database backups provide the required means to restore databases after compromise or loss. Backups help reduce the vulnerability to unauthorized access or hardware loss.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the database backup procedures and implementation evidence.
 
 Evidence of implementation includes records of backup events and physical review of backup media.
 
 Evidence should match the backup plan as recorded in the system documentation.
 
-If backup procedures do not exist or are not implemented in accordance with the procedures, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40937" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000092" dscresource="None">
+If backup procedures do not exist or are not implemented in accordance with the procedures, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40937" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000092" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
-Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.).  Take note of those which are enabled.
 
-Review the system documentation to verify that the enabled components or features are documented and authorized.  If any enabled components or features are not authorized, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40941" severity="high" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
+Review the system documentation to verify that the enabled components or features are documented and authorized.  If any enabled components or features are not authorized, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40941" severity="high" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. 
+It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
 Unused and unnecessary DBMS components increase the attack vector for the DBMS by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.
 
 
-SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the list of components and features installed with the database. Using an account with System Administrator privileges, from Command Prompt, open control.exe.
 
 Navigate to Programs and Features. Check for the following entries in the 'Uninstall or change a program' window.
@@ -384,9 +384,9 @@ Navigate to Programs and Features. Check for the following entries in the 'Unins
 Microsoft SQL Server Data Tools - Database Projects - Web installer entry point
 Prerequisites for SSDT
 
-If SQL Server Data Tools is not documented as a server requirement, and these entries exist, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40947" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000198" dscresource="None">
+If SQL Server Data Tools is not documented as a server requirement, and these entries exist, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40947" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000198" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
 
 If the application were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.
@@ -395,11 +395,11 @@ This requirement is contingent upon the language in which the application is pro
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
 
-DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a greater impact on SQL Server security and operation. It is especially important to grant access to privileged accounts to only those persons who are qualified and authorized to use them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a greater impact on SQL Server security and operation. It is especially important to grant access to privileged accounts to only those persons who are qualified and authorized to use them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check system documentation for policy and procedures to restrict use of the SQL Server software installation account.
 
 
@@ -412,42 +412,42 @@ If appropriate access controls for all users are not implemented to restrict acc
 
 Review procedures for controlling and granting access to use of the SQL Server software installation account.
 
-If access or use of this account is not restricted to the minimum number of personnel required, or unauthorized access to this account has been granted, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40948" severity="high" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
+If access or use of this account is not restricted to the minimum number of personnel required, or unauthorized access to this account has been granted, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40948" severity="high" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of applications and tools related to SQL Server can potentially have significant effects on the overall security of the system. Only qualified and authorized individuals shall be allowed to obtain access to components related to SQL Server for purposes of initiating changes, including upgrades and modifications.
 
 Unmanaged changes that occur to the software libraries or configuration can lead to unauthorized or compromised installations.
 
 Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.
-&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If a security and data integrity tool is not used for monitoring and alerting files and folders based on cryptographic hashes, this is a finding.
 
-If the tool does not verify files/folder locations as listed in the documentation, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40949" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
+If the tool does not verify files/folder locations as listed in the documentation, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40949" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to security-relevant configuration settings of SQL Server can potentially have significant effects on the overall security of the system.
 
 If SQL Server were to allow any user to make changes to configuration settings, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement is contingent upon the configuration of SQL Server's hosted application and the security-relevant configuration settings of SQL Server.
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to these security-relevant configuration settings for purposes of initiating changes, including upgrades and modifications.
 
-Unmanaged changes that occur to SQL Server software libraries or configuration can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unmanaged changes that occur to SQL Server software libraries or configuration can lead to unauthorized or compromised installations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Verify within the system documentation that SQL Server is monitoring for security-relevant configuration settings to discover unauthorized changes.
 
-This can be done by a third-party tool or a SQL script that does baselining and then comparisons. 
+This can be done by a third-party tool or a SQL script that does baselining and then comparisons.
 
-If the monitoring of security-relevant configuration settings to discover unauthorized changes is not implemented on SQL Server, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41034" severity="low" conversionstatus="pass" title="SRG-APP-000080-DB-000063" dscresource="None">
+If the monitoring of security-relevant configuration settings to discover unauthorized changes is not implemented on SQL Server, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41034" severity="low" conversionstatus="pass" title="SRG-APP-000080-DB-000063" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
 
 Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document.
@@ -456,43 +456,43 @@ Use of shared accounts does not provide individual accountability for actions ta
 
 When shared accounts are utilized without another means of identifying individual users, users may deny having performed a particular action.
 
-(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of authorized SQL Server accounts in the system documentation.
 
-If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.) 
+If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.)
 
-If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding. 
+If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding.
 
 Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured.  If shared identifiers are found, and not accompanied by individual identifiers, this is a finding.
 
-Note:  Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.</RawString>
-    </Rule>
-    <Rule id="V-41038" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000022" dscresource="None">
+Note:  Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.</RawString>
+    </Rule>
+    <Rule id="V-41038" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000022" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;This requirement is intended to limit exposure due to operating from within a privileged account. SQL Server does support the organizational requirement that users of information system accounts with access to an organization-defined list of security functions or security-relevant information use non-privileged accounts and roles, when accessing other (non-security) system functions.
 
 Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts if used for non-administration application development or application maintenance can lead to miss-assignment of privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in, and provided by, applications.
 
-The SQL Server installation account requires privileges not required for SQL Server administration or other functions. Use of accounts configured with excess privileges may result in the loss or compromise of data or system settings due to elevated privileges that bypass controls designed to protect them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The SQL Server installation account requires privileges not required for SQL Server administration or other functions. Use of accounts configured with excess privileges may result in the loss or compromise of data or system settings due to elevated privileges that bypass controls designed to protect them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review system documentation to identify the installation account. Verify whether the account is used for anything beyond SQL Server software installation, upgrade, and maintenance actions.
 
-If the account is used for anything beyond SQL Server installation, upgrade, and maintenance actions, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41039" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000021" dscresource="None">
+If the account is used for anything beyond SQL Server installation, upgrade, and maintenance actions, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41039" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000021" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server DBAs, if assigned excessive OS privileges, could perform actions that could endanger the information system or hide evidence of malicious activity.
 
-This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements.  They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements.  They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s).
 
 
@@ -517,20 +517,20 @@ Determine the location of the accounts or groups to be reviewed.  The default is
 
 Right-click each DBA user. Click Properties. Click the 'Member of' tab.  If any parent groups are listed that are not specific to DBA roles, this is a finding.
 
-Right-click each DBA Group.  Click Properties.  Select the 'Members' tab. Review the list of group members.  If any account that does not represent a DBA is listed, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41041" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000019" dscresource="None">
+Right-click each DBA Group.  Click Properties.  Select the 'Members' tab. Review the list of group members.  If any account that does not represent a DBA is listed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41041" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000019" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
 
 Audit of privileged activity may require physical separation, employing information systems on which the user does not have privileged access.
 
 To limit exposure and provide forensic history of activity when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions.
 
-SQL Server provides access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged. DBAs, if assigned excessive privileges, could perform actions that endanger the information system or hide evidence of malicious activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+SQL Server provides access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged. DBAs, if assigned excessive privileges, could perform actions that endanger the information system or hide evidence of malicious activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of all DBAs.
 Obtain documented role assignments for each DBA.
 Obtain from system documentation or use SQL Server to determine privilege assignment of user-defined roles.
@@ -545,14 +545,14 @@ If any checked 'Server roles' are determined to be excessive privileges, this is
 
 Navigate from 'Server Roles' to 'Users mapped to the login'.
 
-If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41044" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000016" dscresource="None">
+If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41044" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000016" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The principle of Least Privilege must be applied to the ability of users to access system tables, system management information, other configuration information, and metadata.  Unauthorized access to this data could result in unauthorized changes to database objects, access controls, or SQL Server configuration.  Only database administrators and other authorized users must be allowed such access.
 
 To aid in tracking and administering such permissions, individual logins must not be directly granted permissions or built-in server roles.  Instead, user-defined server roles must be created, with the permissions and built-in server roles granted to them; the individual logins must be assigned to the appropriate user-defined server roles.
 
-The built-in server role "sysadmin" is a partial exception.  This cannot be granted to a user-defined role, only to a login account.  Most (not necessarily all) database administrators will need to be members of sysadmin.  Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable.  The users who require such access must be documented and approved.  
+The built-in server role "sysadmin" is a partial exception.  This cannot be granted to a user-defined role, only to a login account.  Most (not necessarily all) database administrators will need to be members of sysadmin.  Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable.  The users who require such access must be documented and approved.
 
 In addition, if the site uses backup-restore software that connects to SQL Server via the Virtual Device Interface (VDI), the account used by that software must have the sysadmin role.  (See Microsoft Knowledge Base article 2926557, http://support.microsoft.com/kb/2926557).  If this applies, it must be documented and approved.
 
@@ -728,11 +728,11 @@ sp_vupgrade_mergeobjects
 sp_vupgrade_replication
 sp_vupgrade_replsecurity_metadata
 xp_repl_convert_encrypt_sysadmin_wrapper
-&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Use SQL Server and system documentation to determine privilege assignment of user-defined roles.
 
 Determine which user-defined roles grant privileges to system tables and configuration data stored in SQL Server.
@@ -767,16 +767,16 @@ db_ddladmin
 db_denydatareader
 db_denydatawriter
 db_owner
-db_securityadmin</RawString>
-    </Rule>
-    <Rule id="V-41046" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000011" dscresource="None">
+db_securityadmin</RawString>
+    </Rule>
+    <Rule id="V-41046" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000011" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
-Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of available user-defined server roles from system documentation.
 
 Obtain the list of available user-defined server roles from the SQL Server system by running the following script:
@@ -828,18 +828,18 @@ Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'
 
 If any user-defined role contains permissions that are inconsistent with separation sensitive information assignment, this is a finding.
 
-If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41202" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000009" dscresource="None">
+If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41202" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000009" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action.
 
 Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles.
 
-Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check for direct user assignment to server permissions by running the following script:
 /**********************************************************************************
  LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT
@@ -932,28 +932,28 @@ If any listed user-defined roles are not found in the system documentation, this
 Obtain the list of assigned privileges for all user-defined roles in the system documentation.
 
 Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role.
-Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Server Roles &gt;&gt; right click &lt;'user-defined server role name'&gt; &gt;&gt; Properties &gt;&gt; General &gt;&gt; Securables.  If any roles are found that do not enforce separation of duties, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41204" severity="medium" conversionstatus="pass" title="SRG-APP-000085-DB-000038" dscresource="None">
+Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Server Roles &gt;&gt; right click &lt;'user-defined server role name'&gt; &gt;&gt; Properties &gt;&gt; General &gt;&gt; Securables.  If any roles are found that do not enforce separation of duties, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41204" severity="medium" conversionstatus="pass" title="SRG-APP-000085-DB-000038" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write).
 
 These DAC concepts extend to the server level.  Server instances have the potential for the access controls to propagate without limit, resulting in unauthorized access.
 
-The DBMS must ensure the recipient of server permissions possesses only the access intended. The DBMS must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The DBMS must ensure the recipient of server permissions possesses only the access intended. The DBMS must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check for rights propagation assignment to DBMS server permissions by running the following query:
 
 USE master;
-SELECT * 
+SELECT *
 FROM sys.server_permissions
 WHERE state_desc = 'GRANT_WITH_GRANT_OPTION';
 
-If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41205" severity="medium" conversionstatus="pass" title="SRG-APP-000036-DB-000174" dscresource="None">
+If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41205" severity="medium" conversionstatus="pass" title="SRG-APP-000036-DB-000174" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains).
 
 DAC is a type of access control methodology serving as a means of restricting access to objects and data based on the identity of subjects and/or groups to which they belong. It is discretionary in the sense that application users with the appropriate permissions to access an application resource or data have the discretion to pass that permission on to another user either directly or indirectly.
@@ -962,11 +962,11 @@ Data protection requirements may result in a DAC policy being specified as part
 
 When DAC controls are employed, those controls must limit sharing to named application users, groups of users, or both. The application DAC controls must also limit the propagation of access rights and have the ability to exclude access to data down to the granularity of a single user.
 
-Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check for direct user assignment to server permissions by running the following script:
 /**********************************************************************************
  LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT
@@ -1057,20 +1057,20 @@ If any listed user-defined roles are not found in the system documentation, this
 Obtain the list of user role assignments in the system documentation.
 
 Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role.
-Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Server Roles &gt;&gt; right click &lt;'user-defined server role name'&gt; &gt;&gt; Properties &gt;&gt; Members.  If any roles are found that are not authorized and documented, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41304" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Server Roles &gt;&gt; right click &lt;'user-defined server role name'&gt; &gt;&gt; Properties &gt;&gt; Members.  If any roles are found that are not authorized and documented, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41304" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Non-DAC controls are determined by policy makers and are managed centrally or by a central authority. These controls must not be changed at the discretion of ordinary application users. Data protection requirements may result in a non-DAC policy being specified as part of the application design. Non-DACs are employed at the application level to restrict and control access to application data, thereby providing increased information security for the organization.
 
 SQL Server Non-DAC is maintained through the use of Roles. Roles are set up within SQL Server to grant user accounts read and/or write permissions to system objects: databases, tables, columns, etc. After a role is created, user accounts can be assigned to a role granting them permissions of that role.
 
 If users have permissions to database objects that they are not authorized to have, the user account that has access to the unauthorized database object must be removed from the role that grants that access. Policy rule sets would be developed to establish that each user receives only the information to which the user is authorized.
 
-Frequently, roles grant access to multiple privileges; if a user is authorized and determined to need access to authorized privilege granted by a role, and unauthorized for other privileges of that same role, it may be necessary to split the privileges of one role into two roles.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Frequently, roles grant access to multiple privileges; if a user is authorized and determined to need access to authorized privilege granted by a role, and unauthorized for other privileges of that same role, it may be necessary to split the privileges of one role into two roles.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check for direct user assignment to server permissions by running the following script:
 /**********************************************************************************
 LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT
@@ -1165,9 +1165,9 @@ Obtain the list of user role assignments in the system documentation.
 Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role.
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Server Roles &gt;&gt; right click &lt;'user-defined server role name'&gt; &gt;&gt; Properties &gt;&gt; Members.
 
-If both user-defined role(s) and user(s) are listed as "Member of this role", this is a propagation of access rights, and this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41311" severity="medium" conversionstatus="pass" title="SRG-APP-000001-DB-000031" dscresource="None">
+If both user-defined role(s) and user(s) are listed as "Member of this role", this is a propagation of access rights, and this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41311" severity="medium" conversionstatus="pass" title="SRG-APP-000001-DB-000031" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks. For example, boundary protection devices can filter certain types of packets to protect devices on an organization’s internal network from being directly affected by DoS attacks.
 
 One way SQL Server can limit exposure to DoS attacks is to restrict the number of connections that can be opened by a single user. SQL Server supports this through the use of logon triggers.  (Note, however, that this need not be the only, or even the principal, means for satisfying this requirement.  Depending on the architecture and capabilities of the network and application, a network device or an application may be more suitable for providing this protection.)
@@ -1176,27 +1176,27 @@ When determining the appropriate values for this limit, take the characteristics
 
 Architectural note:  In SQL Server, a count of active sessions by user can be obtained from one of the dynamic management views.   For example:
 
-    SELECT original_login_name, count(*) 
-    FROM sys.dm_exec_sessions
-    WHERE is_user_process = 1
-    GROUP BY original_login_name;
+ SELECT original_login_name, count(*)
+ FROM sys.dm_exec_sessions
+ WHERE is_user_process = 1
+ GROUP BY original_login_name;
 
-However, for this to return an accurate count in a logon trigger, the user would have to have the View Server State privilege.  (Without this privilege, the trigger sees information only about the current session, so would always return a count of one.)  View Server State would give that user access to a wide swath of information about the server, violating SQL2-00-004100.  One way to avoid this exposure is to create a summary table, and a view of that table that restricts each user to seeing his/her own count, and establish a frequently-run background job to refresh the table (using the above query or similar).  The logon trigger then queries the view to obtain a count that is accurate enough for most purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+However, for this to return an accurate count in a logon trigger, the user would have to have the View Server State privilege.  (Without this privilege, the trigger sees information only about the current session, so would always return a count of one.)  View Server State would give that user access to a wide swath of information about the server, violating SQL2-00-004100.  One way to avoid this exposure is to create a summary table, and a view of that table that restricts each user to seeing his/her own count, and establish a frequently-run background job to refresh the table (using the above query or similar).  The logon trigger then queries the view to obtain a count that is accurate enough for most purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the system documentation to determine whether any limits have been defined.  If not, this is a finding.
 
 If one limit has been defined but is not applied to all users, including privileged administrative accounts, this is a finding.
 
-If multiple limits have been defined, to accommodate different types of user, verify that together they cover all users.  If not, this is a finding. 
+If multiple limits have been defined, to accommodate different types of user, verify that together they cover all users.  If not, this is a finding.
 
 If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means.  If it does not work correctly, this is a finding.
 
 Otherwise, determine if a logon trigger exists:
 
-EITHER, in SQL Server Management Studio's Object Explorer tree: 
+EITHER, in SQL Server Management Studio's Object Explorer tree:
 Expand [SQL Server Instance] &gt;&gt; Security &gt;&gt; Server Objects &gt;&gt; Triggers
 
 OR run the query:
@@ -1204,38 +1204,38 @@ SELECT * FROM master.sys.server_triggers;
 
 If no triggers are listed, this is a finding.
 
-If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user.  If none are found, this is a finding. If they are present but disabled, this is a finding.  
+If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user.  If none are found, this is a finding. If they are present but disabled, this is a finding.
 
 Examine the trigger source code for logical correctness and for compliance with the documented limit(s).  If errors or variances exist, this is a finding.
 
-Verify that the system does execute the trigger(s) each time a user session is established.  If it does not operate correctly for all types of user, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-53877" severity="medium" conversionstatus="pass" title="SRG-APP-000196-DB-000301" dscresource="None">
+Verify that the system does execute the trigger(s) each time a user session is established.  If it does not operate correctly for all types of user, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-53877" severity="medium" conversionstatus="pass" title="SRG-APP-000196-DB-000301" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data.
 
 Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
 
-Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the system exists in the Classified environment, this is NA.
 
 For each database under the SQL Server instance, review the system documentation to determine whether the database holds sensitive information. If it does not, this is not a finding.
 
-If it does handle sensitive information, review the system documentation and configuration to determine whether the sensitive information is protected by NIST-approved cryptography.  If not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-70625" severity="low" conversionstatus="pass" title="SRG-APP-000516-DB-999900" dscresource="None">
+If it does handle sensitive information, review the system documentation and configuration to determine whether the sensitive information is protected by NIST-approved cryptography.  If not, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-70625" severity="low" conversionstatus="pass" title="SRG-APP-000516-DB-999900" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer.  It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems.  It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network.
 
 This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources.  Therefore, it is necessary to consider whether the SQL Server Browser is needed.  Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value.   The more complex the installation, the more likely SQL Server Browser is to be helpful.
 
-This requirement is not intended to prohibit use of the Browser service in any circumstances; rather, it calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+This requirement is not intended to prohibit use of the Browser service in any circumstances; rather, it calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the need for the SQL Server Browser service is documented, with appropriate approval, this is not a finding.
 
 Open the Services tool.
@@ -1244,9 +1244,9 @@ Either navigate, via the Windows Start Menu and/or Control Panel, to "Administra
 
 Scroll to "SQL Server Browser".
 
-If its Startup Type is not shown as "Disabled", this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-72413" severity="medium" conversionstatus="pass" title="SRG-APP-000164-DB-000401" dscresource="None">
+If its Startup Type is not shown as "Disabled", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-72413" severity="medium" conversionstatus="pass" title="SRG-APP-000164-DB-000401" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Windows domain/enterprise authentication and identification must be used (SQL2-00-023600). Native SQL Server authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved.
 
 The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval.
@@ -1261,26 +1261,26 @@ a. minimum of 15 Characters, 1 of each of the following character sets:
 - Special characters (e.g. ~ ! @ # $ % ^ &amp; * ( ) _ + = - ' [ ] / ? &gt; &lt;)];
 b. Minimum number of characters changed from previous password: 50% of the minimum password length (that is, 8).
 
-To enforce this in SQL Server, configure each DBMS-managed login to inherit the rules from Windows.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+To enforce this in SQL Server, configure each DBMS-managed login to inherit the rules from Windows.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Run the statement:
 SELECT
     name
-FROM 
-    sys.sql_logins 
+FROM
+    sys.sql_logins
 WHERE
     type_desc = 'SQL_LOGIN'
     AND is_disabled = 0
-    AND is_policy_checked = 0 ; 
+    AND is_policy_checked = 0 ;
 
 If no account names are listed, this is not a finding.
 
-For each account name listed, determine whether it is documented as requiring exemption from the standard password complexity rules.  If it is not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-72415" severity="medium" conversionstatus="pass" title="SRG-APP-000164-DB-000401" dscresource="None">
+For each account name listed, determine whether it is documented as requiring exemption from the standard password complexity rules.  If it is not, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-72415" severity="medium" conversionstatus="pass" title="SRG-APP-000164-DB-000401" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Windows domain/enterprise authentication and identification must be used (SQL2-00-023600). Native SQL Server authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved.
 
 The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval.
@@ -1292,11 +1292,11 @@ a. Password lifetime limits for interactive accounts:  Minimum 24 hours, Maximum
 b. Password lifetime limits for non-interactive accounts:  Minimum 24 hours, Maximum 365 days
 c. Number of password changes before an old one may be reused:  Minimum of 5.
 
-To enforce this in SQL Server, configure each DBMS-managed login to inherit the rules from Windows.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+To enforce this in SQL Server, configure each DBMS-managed login to inherit the rules from Windows.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Run the statement:
 SELECT
 name
@@ -1309,70 +1309,70 @@ AND is_expiration_checked = 0;
 
 If no account names are listed, this is not a finding.
 
-For each account name listed, determine whether it is documented as requiring exemption from the standard password lifetime rules, if it is not, this is a finding.</RawString>
-    </Rule>
-  </DocumentRule>
-  <ManualRule dscresourcemodule="None">
-    <Rule id="V-40905" severity="medium" conversionstatus="pass" title="SRG-APP-000268-DB-000164" dscresource="None">
+For each account name listed, determine whether it is documented as requiring exemption from the standard password lifetime rules, if it is not, this is a finding.</RawString>
+    </Rule>
+  </DocumentRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-40905" severity="medium" conversionstatus="pass" title="SRG-APP-000268-DB-000164" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Predictable failure prevention requires organizational planning to address system failure issues. If components key to maintaining system security fail to function, then SQL Server could continue operating in an unsecure state. The organization must be prepared, and the system must be configured, to send an alarm for such conditions and/or automatically shut SQL Server down.
 
 If appropriate actions are not taken when component failures occur, a denial of service condition may occur. Appropriate actions can include conducting a graceful application shutdown to avoid losing information.
 
-For the purposes of this requirement, "component" may be interpreted as meaning any of the Windows services that comprise a SQL Server instance.  "The system" encompasses SQL Server itself, the Windows operating system, and any monitoring/management tools used to control the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+For the purposes of this requirement, "component" may be interpreted as meaning any of the Windows services that comprise a SQL Server instance.  "The system" encompasses SQL Server itself, the Windows operating system, and any monitoring/management tools used to control the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check the configuration of SQL Server, the operating system and any monitoring/management tools to verify the system activates an alarm and/or triggers a shutdown of SQL Server when a component failure is detected.
 
-If system does not take either or both actions, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40906" severity="medium" conversionstatus="pass" title="SRG-APP-000265-DB-000161" dscresource="None">
+If system does not take either or both actions, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40906" severity="medium" conversionstatus="pass" title="SRG-APP-000265-DB-000161" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The structure and content of SQL Server error messages need to be carefully considered by the organization and development team. The extent to which the application is able to identify and handle error conditions is guided by organizational policy and operational requirements.
 
-Database logs can be monitored for specific security-related errors. Any error that can have a negative effect on database security should be quickly identified and forwarded to the appropriate personnel. If security-relevant error conditions are not identified by SQL Server they may be overlooked by the personnel responsible for addressing them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Security-related errors must be identified and monitored. In most cases, these items would appear in the SQL Server log file.  
+Database logs can be monitored for specific security-related errors. Any error that can have a negative effect on database security should be quickly identified and forwarded to the appropriate personnel. If security-relevant error conditions are not identified by SQL Server they may be overlooked by the personnel responsible for addressing them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security-related errors must be identified and monitored. In most cases, these items would appear in the SQL Server log file.
 
-If security-related error conditions are not being monitored to meet this requirement, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40910" severity="medium" conversionstatus="pass" title="SRG-APP-000233-DB-000124" dscresource="None">
+If security-related error conditions are not being monitored to meet this requirement, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40910" severity="medium" conversionstatus="pass" title="SRG-APP-000233-DB-000124" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security functions are defined as "the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based".
 
 Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles.
 
-Database Management Systems typically separate security functionality from nonsecurity functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and nonsecurity functionality is commingled, users who have access to nonsecurity functionality may be able to access security functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Database Management Systems typically separate security functionality from nonsecurity functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and nonsecurity functionality is commingled, users who have access to nonsecurity functionality may be able to access security functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Determine elements of security functionality (lists of permissions, additional authentication information, stored procedures, application specific auditing, etc.) which are being housed inside SQL server.
 
 For any elements found, check SQL Server to determine if these objects or code implementing security functionality are located in a separate security domain, such as a separate database or schema created specifically for security functionality.
 
 Run the following queryto list all the user-defined databases:
-SELECT Name 
-FROM sys.databases 
-WHERE database_id &gt; 4 
+SELECT Name
+FROM sys.databases
+WHERE database_id &gt; 4
 ORDER BY 1;
 
-If security-related database objects or code are not kept separate, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40915" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
+If security-related database objects or code are not kept separate, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40915" severity="medium" conversionstatus="pass" title="SRG-APP-000201-DB-000145" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server OS must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it.
 
 The user account associated with public access must not have access to the OS configuration information. Determine what publicly available user account is being used to access SQL Server and validate that the publicly available user account only has read access to the public data and nothing else.
 
 The OS level 'Guests' role grants connection access to the server without granting any other privileges. SQL Server configuration settings are used to grant access to the publicly available information, but this control ensures that the OS only is granted connection access to the server.
 
-This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If SQL Server is not housing or distributing publicly available information, this finding is NA.
 
 If SQL Server supports an application collecting information from the public, this is NA.
@@ -1389,55 +1389,55 @@ In lusrmgr.msc, navigate to Users. Right click publicly available account name.
 
 If the publicly available user account is found in any group 'Members' listing other than 'Guests', this is a finding.
 
-In SQL, for the account that is used for public access, ensure that read-only access is the only access granted. If any other access is granted, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40922" severity="medium" conversionstatus="pass" title="SRG-APP-000171-DB-000074" dscresource="None">
+In SQL, for the account that is used for public access, ensure that read-only access is the only access granted. If any other access is granted, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40922" severity="medium" conversionstatus="pass" title="SRG-APP-000171-DB-000074" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server must enforce password encryption when storing passwords. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read and easily compromised.
 
-Passwords stored in clear text are vulnerable to unauthorized disclosure. Database passwords should always be encoded or encrypted when stored internally or externally to SQL Server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Since Windows security is being leveraged, this check applies to database configuration files, associated scripts, and applications external to SQL Server that access the database.  
+Passwords stored in clear text are vulnerable to unauthorized disclosure. Database passwords should always be encoded or encrypted when stored internally or externally to SQL Server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Since Windows security is being leveraged, this check applies to database configuration files, associated scripts, and applications external to SQL Server that access the database.
 
-Ask the DBA and/or IAO to determine if any SQL Server database objects, database configuration files, associated scripts, or applications defined as external to SQL Server that access the database/user environment files/settings contain database passwords. If any do, confirm that SQL Server passwords stored externally to the SQL Server are encoded or encrypted. If any passwords are stored in clear text, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40923" severity="medium" conversionstatus="pass" title="SRG-APP-000153-DB-000108" dscresource="None">
+Ask the DBA and/or IAO to determine if any SQL Server database objects, database configuration files, associated scripts, or applications defined as external to SQL Server that access the database/user environment files/settings contain database passwords. If any do, confirm that SQL Server passwords stored externally to the SQL Server are encoded or encrypted. If any passwords are stored in clear text, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40923" severity="medium" conversionstatus="pass" title="SRG-APP-000153-DB-000108" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;To ensure individual accountability and prevent unauthorized access, application users (and any processes acting on behalf of users) must be individually identified and authenticated.
 
 A shared authenticator is a generic account used by multiple individuals. Use of a shared authenticator alone does not uniquely identify individual users. An example of a shared authenticator is the UNIX OS 'root' user account, a Windows 'administrator' account, an 'sa' account, or a 'helpdesk' account.
 
 Legitimate use of shared accounts includes, for example, connection pooling.  Since this is insufficient to ensure non-repudiation, such shared accounts should be kept "under the covers," be inaccessible directly to end users, be invoked only after successful individual authentication, be communicated to the DBMS by the application, and be recorded in all relevant audit contexts.
 
-(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review SQL Server users to determine whether shared accounts exist.
 
 If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.
 
-If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40924" severity="medium" conversionstatus="pass" title="SRG-APP-000148-DB-000103" dscresource="None">
+If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40924" severity="medium" conversionstatus="pass" title="SRG-APP-000148-DB-000103" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;To ensure accountability and prevent unauthorized SQL Server access, organizational users shall be identified and authenticated.
 
 Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations).
 
-Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on SQL Server without identification or authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on SQL Server without identification or authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review SQL Server users to determine whether shared accounts exist. (This does not include when SQL Server has a guest or public account that is providing access to publicly available information.)
 
 If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding.
 
-If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40925" severity="medium" conversionstatus="pass" title="SRG-APP-000146-DB-000100" dscresource="None">
+If accounts are determined to be shared, determine if they are directly accessible to end users.  If so, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40925" severity="medium" conversionstatus="pass" title="SRG-APP-000146-DB-000100" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server backups are a critical step in maintaining data assurance and availability.
 
 System-level information includes system-state information, operating system and application software, and licenses.
@@ -1446,15 +1446,15 @@ Backups shall be consistent with organization-defined recovery time and recovery
 
 SQL Server depends upon the availability and integrity of its software libraries. Without backups, compromise or loss of the software libraries can prevent a successful recovery of SQL Server operations.
 
-A mixture of full and incremental server-level backups by a third-party tool that backs up those software library directories would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+A mixture of full and incremental server-level backups by a third-party tool that backs up those software library directories would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review evidence of inclusion of SQL Server software libraries in current backup records.
-If the backup tool does not include SQL Server, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40926" severity="medium" conversionstatus="pass" title="SRG-APP-000146-DB-000099" dscresource="None">
+If the backup tool does not include SQL Server, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40926" severity="medium" conversionstatus="pass" title="SRG-APP-000146-DB-000099" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server backups are a critical step in maintaining data assurance and availability.
 
 System-level information includes:  system-state information, operating system and application software, and licenses.
@@ -1463,41 +1463,41 @@ Backups shall be consistent with organizationally defined recovery time and reco
 
 SQL Server depends upon the availability and integrity of its system-level information. Without backups, compromise or loss of system-level information can prevent a successful recovery of SQL Server operations. If SQL Server system-level information is not backed up regularly this risks the loss of SQL Server data in the event of a system failure.
 
-A mixture of full and incrementally server level backups that backup the system-level information would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+A mixture of full and incrementally server level backups that backup the system-level information would satisfy this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.
 
-Check evidence of inclusion of system-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including system-level information backups, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40930" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000095" dscresource="None">
+Check evidence of inclusion of system-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including system-level information backups, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40930" severity="medium" conversionstatus="pass" title="SRG-APP-000145-DB-000095" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server backups are a critical step in maintaining data assurance and availability.
 
 User-level information is data generated by information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media.
 
 Applications performing backups must be capable of backing up user-level information per the DoD defined frequency.
 
-Databases that do not backup information regularly risk the loss of that information in the event of a system failure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Databases that do not backup information regularly risk the loss of that information in the event of a system failure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding.
 
-Check evidence of inclusion user-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including user-level information backups, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40932" severity="high" conversionstatus="pass" title="SRG-APP-000144-DB-000101" dscresource="None">
+Check evidence of inclusion user-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including user-level information backups, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40932" severity="high" conversionstatus="pass" title="SRG-APP-000144-DB-000101" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Application recovery and reconstitution constitutes executing an information system contingency plan comprising activities that restore essential missions and business functions.
 
 SQL Server utilizes transaction-based processing and is a good example of information systems that are transaction-based. Transaction rollback and transaction journaling are examples of mechanisms supporting transaction recovery.
 
-SQL Server may be vulnerable to use of compromised data or other critical files during recovery. Use of compromised files could introduce maliciously altered application code, relaxed security settings, or loss of data integrity. SQL Server mechanisms must be configured to protect all files that could compromise the system or its data during a SQL Server recovery.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+SQL Server may be vulnerable to use of compromised data or other critical files during recovery. Use of compromised files could introduce maliciously altered application code, relaxed security settings, or loss of data integrity. SQL Server mechanisms must be configured to protect all files that could compromise the system or its data during a SQL Server recovery.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server recovery procedures and technical system features to determine if mechanisms exist and are in place to specify use of trusted files during SQL Server recovery.
 
 If recovery procedures do not exist or are not sufficient to ensure recovery is done in a secure and verifiable manner, this is a finding.
@@ -1518,24 +1518,24 @@ SELECT ''?'' AS ''database name''
  WHERE type_desc = ''LOG''
    AND state = 0;
 '
-; 
+;
 
-If any transaction log files are not configured correctly for size, max_size, and growth to log sufficient transaction information, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40933" severity="medium" conversionstatus="pass" title="SRG-APP-000142-DB-000094" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 
+If any transaction log files are not configured correctly for size, max_size, and growth to log sufficient transaction information, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40933" severity="medium" conversionstatus="pass" title="SRG-APP-000142-DB-000094" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services) but doing so increases risk over limiting the services provided by any one component.  
+Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services) but doing so increases risk over limiting the services provided by any one component.
 
 To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.
 
 Database Management Systems using ports, protocols, and services deemed unsafe are open to attack through those ports, protocols, and services. This can allow unauthorized access to the database and, through the database, to other components of the information system.
 
-For detailed guidance on Ports, Protocols, and Services Management (PPSM), refer to the PPSM section of the Information Assurance Support Environment (IASE) web site, at http://iase.disa.mil/ppsm/Pages/index.aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+For detailed guidance on Ports, Protocols, and Services Management (PPSM), refer to the PPSM section of the Information Assurance Support Environment (IASE) web site, at http://iase.disa.mil/ppsm/Pages/index.aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the SQL Server configuration and settings for functions, ports, protocols, and services that are not approved or are not used, but are available.
 
 To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager.  In the left-hand pane, expand SQL Server Network Configuration.  Click on the entry for the SQL Server instance under review:  "Protocols for &lt;instance name&gt;".  The right-hand pane displays the protocols enabled for the instance.
@@ -1544,16 +1544,16 @@ To determine whether SQL Server is configured to use a fixed port or dynamic por
 
 To see which ports are open on the server, run netstat-a from a Windows command prompt.
 
-If any ports, protocols, and/or services that are not approved or are not used, are available, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40934" severity="medium" conversionstatus="pass" title="SRG-APP-000142-DB-000094" dscresource="None">
+If any ports, protocols, and/or services that are not approved or are not used, are available, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40934" severity="medium" conversionstatus="pass" title="SRG-APP-000142-DB-000094" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services), but doing so increases risk over limiting the services provided by any one component.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services), but doing so increases risk over limiting the services provided by any one component.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review the list of user-defined Stored Procedures and Functions by running the following SQL query:
 EXEC sp_MSforeachdb
 '
@@ -1572,44 +1572,44 @@ SELECT ''?'' AS ''Table Name'', *
 '
 ;
 
-If any user-defined Stored Procedures and Functions are unauthorized and therefore should be prohibited or restricted and are not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40935" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000093" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).  
+If any user-defined Stored Procedures and Functions are unauthorized and therefore should be prohibited or restricted and are not, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40935" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000093" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements; or providing a wide array of functionality not required for every mission, but which cannot be disabled. 
+It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements; or providing a wide array of functionality not required for every mission, but which cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
 DBMSs may spawn additional external processes to execute procedures that are defined in the DBMS, but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than the DBMS and provide unauthorized access to the host system.
 
-The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>To determine if xp_cmdshell is enabled, execute the following commands:
 
 EXEC SP_CONFIGURE 'show advanced option', '1';
 RECONFIGURE WITH OVERRIDE;
 EXEC SP_CONFIGURE 'xp_cmdshell';
 
-If the value of config_value is 1, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40938" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
+If the value of config_value is 1, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40938" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
-It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. 
+It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities.
 
 Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.
 
-SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the SQL Server service "SQL Server Analysis Services (MSSQLSERVER)" is used and the service satisfies functional organizational requirement, this is not a finding.
 
 If there is no functional organizational requirement for the "SQL Server Analysis Services (MSSQLSERVER)" service make sure that the service is not installed or is disabled.
@@ -1618,9 +1618,9 @@ From command prompt, using an account with System Administrator Privilege, open
 
 If the "SQL Server Analysis Services (MSSQLSERVER)" service does not exist, this is not a finding.
 
-If the "SQL Server Analysis Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not "Disabled", this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40939" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
+If the "SQL Server Analysis Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not "Disabled", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40939" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled.
@@ -1629,11 +1629,11 @@ Applications must adhere to the principles of least functionality by providing o
 
 Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.
 
-SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If the SQL Server service "SQL Server Integration Services 11.0" is used and the service satisfies functional organizational requirement, this is not a finding.
 
 If there is no functional organizational requirement for the "SQL Server Integration Services 11.0" service make sure that the service is not installed or is disabled.
@@ -1642,9 +1642,9 @@ From command prompt, using an account with System Administrator Privilege, open
 
 If the "SQL Server Integration Services 11.0" service does not exist, this is not a finding.
 
-If the "SQL Server Integration Services 11.0" status is "Started" or the "Startup Type" is not "Disabled", this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40940" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
+If the "SQL Server Integration Services 11.0" status is "Started" or the "Startup Type" is not "Disabled", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40940" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000091" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled.
@@ -1653,11 +1653,11 @@ Applications must adhere to the principles of least functionality by providing o
 
 Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced.
 
-SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>If there is no functional organizational requirement for the "SQL Server Reporting Services (MSSQLSERVER)" service, make sure that the service is not installed or that the service is disabled.
 
 If the SQL Server service "SQL Server Reporting Services (MSSQLSERVER)" is used and the service satisfies functional organizational requirement, this is not a finding.
@@ -1667,20 +1667,20 @@ From command prompt, using an account with System Administrator Privilege, open
 
 If the "SQL Server Reporting Services (MSSQLSERVER)" service does not exist, this is not a finding.
 
-If the "SQL Server Reporting Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not set to "Disabled", this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40944" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
+If the "SQL Server Reporting Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not set to "Disabled", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40944" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system.
 
 If any user were allowed to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.  The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in compromised installations. This may in turn jeopardize data stored in the DBMS and/or operation of the host system.
 
 Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
 
-Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location:
 HKEY_LOCAL_MACHINE
 &gt;&gt; SOFTWARE
@@ -1762,22 +1762,22 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 8) Click "OK"
 9) Permission like a normal user from here
 
-Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. 
+Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.
 
 Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.)
-</RawString>
-    </Rule>
-    <Rule id="V-40945" severity="high" conversionstatus="pass" title="SRG-APP-000133-DB-000205" dscresource="None">
+</RawString>
+    </Rule>
+    <Rule id="V-40945" severity="high" conversionstatus="pass" title="SRG-APP-000133-DB-000205" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.
 
 Any time new software code is introduced to a system there is the potential for unintended consequences. There have been documented instances where the application of a patch has caused problems with system integrity or availability. Due to information system integrity and availability concerns, organizations must give careful consideration to the methodology used to carry out automatic updates.
 
-If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Check Microsoft's list of supported SQL Server versions.  To locate the correct web page, perform a web search for "Microsoft SQL Server end of support."
+If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Check Microsoft's list of supported SQL Server versions. To locate the correct web page, perform a web search for "Microsoft SQL Server end of support."
 
 To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerabilities.
 
@@ -1786,16 +1786,20 @@ print @@version
 
 If the security patch support for SQL Server cannot be determined or SQL Server version is not shown as supported, this is a finding.
 
-If SQL Server does not contain the latest security patches, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40946" severity="low" conversionstatus="pass" title="SRG-APP-000133-DB-000199" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. 
+If SQL Server does not contain the latest security patches, this is a finding.
+
+SQL Server 2012 Service Pack 3 support end date: 10/9/2018
+SQL Server 2012 Enterprise Core mainstream support end date: 7/11/2018
+SQL Server 2012 Enterprise Core extended support end date: 7/12/2022</RawString>
+    </Rule>
+    <Rule id="V-40946" severity="low" conversionstatus="pass" title="SRG-APP-000133-DB-000199" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
 
-Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Verify the SQL Server installations present on the server.
 
 From a Command Prompt, type regedit.exe, and press [ENTER].
@@ -1806,23 +1810,23 @@ Analysis Services Instances are registered in the OLAP subfolder.
 Reporting Services Instances are registered in the RS subfolder.
 Standard SQL Server Instances are registered in the SQL subfolder.
 
-Inside each of these folders, a single key is used to reference an Instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: 
+Inside each of these folders, a single key is used to reference an Instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location:
 
 HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME].
 
-An [INSTANCE NAME] is listed as the Data component of a key found in one of the above OLAP, RS, or SQL folders.  
+An [INSTANCE NAME] is listed as the Data component of a key found in one of the above OLAP, RS, or SQL folders.
 
 To find the installation location of a particular instance, navigate to the following location in the Windows Registry:
 
-HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME] &gt;&gt; Setup.  
+HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME] &gt;&gt; Setup.
 
 Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance.
 
 Navigate to that folder location using a Command Prompt or Windows Explorer. Only applications that are required for the functioning and administration, not use, of the SQL Server should be located on the same directory node as the SQL Server software libraries.
 
-If any files or subfolders that are not part of the SQL Server installation are in the folder, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40951" severity="medium" conversionstatus="pass" title="SRG-APP-000129-DB-000087" dscresource="None">
+If any files or subfolders that are not part of the SQL Server installation are in the folder, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40951" severity="medium" conversionstatus="pass" title="SRG-APP-000129-DB-000087" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;When dealing with access restrictions pertaining to change control, it should be noted, any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
 
 Only qualified and authorized individuals are allowed to obtain access to information system components for the purposes of initiating changes, upgrades, and modifications.
@@ -1831,11 +1835,11 @@ Access restrictions for change also include application software libraries.
 
 Examples of access restrictions include: physical and logical access controls, workflow automation, media libraries, abstract layers (i.e., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (i.e., changes occur only during specified times, making unauthorized changes outside the window easy to discover).
 
-Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens, and is threatened by, other hosted applications. Access controls defined for one application may, by default, provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens, and is threatened by, other hosted applications. Access controls defined for one application may, by default, provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server software library installation directory location.
 
 From a command prompt, type regedit.exe, and press [ENTER].
@@ -1848,16 +1852,16 @@ Standard SQL Server Instances are registered in the SQL subfolder.
 
 Inside each one of these folders, a single key is used to reference an instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME].
 
-An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders.  
+An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders.
 
 To find the installation location of a particular instance, navigate to the following location in the Windows Registry:
  HKEY_LOCAL_MACHINE &gt;&gt; SOFTWARE &gt;&gt; Microsoft &gt;&gt; Microsoft SQL Server &gt;&gt; [INSTANCE NAME] &gt;&gt; Setup.  Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance.
 
 Navigate to that folder location using a command prompt or Windows Explorer. Note any custom subdirectories within the SQL Server software library directory. Only applications that are required for the functioning and administration of SQL Server should be located in the same disk directory as the SQL Server software libraries.
 
-If any directories or files not installed with the SQL Server software exist within the SQL Server software library directory, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-40952" severity="low" conversionstatus="pass" title="SRG-APP-000120-DB-000061" dscresource="None">
+If any directories or files not installed with the SQL Server software exist within the SQL Server software library directory, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-40952" severity="low" conversionstatus="pass" title="SRG-APP-000120-DB-000061" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve.
 
 To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods, which will depend upon system architecture and design.
@@ -1868,13 +1872,13 @@ Applications providing a user interface to audit data will leverage user permiss
 
 Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.
 
-Deletion of database audit data could mask the theft or unauthorized modification of sensitive data stored in the database.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Deletion of database audit data could mask the theft or unauthorized modification of sensitive data stored in the database.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -1890,10 +1894,10 @@ Administrator(read)
 Users (none)
 Audit Administrator (Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
 
-If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. 
+If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding.
 
 If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding
 -----
@@ -1915,9 +1919,9 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 7.b.i) Type "NT SERVICE\SQL" and click "Check Names"
 7.b.ii) Select the "SQLAgent$&lt;instance name&gt;" user and click OK
 8) Click OK
-9) Permission like a normal user from here</RawString>
-    </Rule>
-    <Rule id="V-40953" severity="low" conversionstatus="pass" title="SRG-APP-000119-DB-000060" dscresource="None">
+9) Permission like a normal user from here</RawString>
+    </Rule>
+    <Rule id="V-40953" severity="low" conversionstatus="pass" title="SRG-APP-000119-DB-000060" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve.
 
 To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.
@@ -1928,13 +1932,13 @@ Applications providing a user interface to audit data will leverage user permiss
 
 Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.
 
-Modification of database audit data could mask the theft or unauthorized modification of sensitive data stored in the database.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Modification of database audit data could mask the theft or unauthorized modification of sensitive data stored in the database.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -1950,16 +1954,16 @@ Administrator(read)
 Users (none)
 Audit Administrator (Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
 
-If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. 
+If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding.
 
 If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding.
 
-If Trace is in use, SQL Server creates each trace file with a standard set of permissions, overriding the folder permissions.  It grants full control to OWNER RIGHTS, Administrators and &lt;SQL Server Instance name&gt;.  Since this is not configurable, this is not a finding.</RawString>
-    </Rule>
-    <Rule id="V-41016" severity="medium" conversionstatus="pass" title="SRG-APP-000118-DB-000059" dscresource="None">
+If Trace is in use, SQL Server creates each trace file with a standard set of permissions, overriding the folder permissions.  It grants full control to OWNER RIGHTS, Administrators and &lt;SQL Server Instance name&gt;.  Since this is not configurable, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-41016" severity="medium" conversionstatus="pass" title="SRG-APP-000118-DB-000059" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage.
 
 To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc.
@@ -1968,13 +1972,13 @@ SQL Server and third-party tools are examples of applications that are easily ab
 
 This requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections, and limiting log data location.
 
-Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -1990,11 +1994,11 @@ Administrator(read)
 Users (none)
 Audit Administrator (Full Control)
 Auditors group (Read)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2]
 
 
-If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. 
+If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding.
 
 If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding.
 
@@ -2017,9 +2021,9 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 7.b.i) Type "NT SERVICE\SQL" and click "Check Names"
 7.b.ii) Select the "SQLAgent$&lt;instance name&gt;" user and click OK
 8) Click OK
-9) Permission like a normal user from here</RawString>
-    </Rule>
-    <Rule id="V-41017" severity="medium" conversionstatus="pass" title="SRG-APP-000127-DB-000172" dscresource="None">
+9) Permission like a normal user from here</RawString>
+    </Rule>
+    <Rule id="V-41017" severity="medium" conversionstatus="pass" title="SRG-APP-000127-DB-000172" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place.
 
 Auditing might not be reliable when performed by an information system that the user being audited has privileged access to.
@@ -2028,13 +2032,13 @@ The privileged user could inhibit auditing or directly modify audit records. To
 
 Reducing the risk of audit compromises by privileged users can also be achieved, for example, by performing audit activity on a separate information system where the user in question has limited access, or by using storage media that cannot be modified (e.g., write-once recording devices).
 
-If an attacker were to gain access to audit tools, they could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If an attacker were to gain access to audit tools, they could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server audit file location(s) by running the following SQL script:
-SELECT DISTINCT 
+SELECT DISTINCT
 LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path"
 FROM sys.traces
 UNION
@@ -2052,18 +2056,18 @@ Audit Administrator (Full Control)
 Auditors group (Read)
 SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2]
-If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41023" severity="low" conversionstatus="pass" title="SRG-APP-000103-DB-000050" dscresource="None">
+If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41023" severity="low" conversionstatus="pass" title="SRG-APP-000103-DB-000050" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Audit processing failures include:  software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
 
 If audit log capacity were to be exceeded, then events subsequently occurring will not be recorded. Organizations shall define a maximum allowable percentage of storage capacity serving as an alarming threshold (e.g., application has exceeded 80% of log storage capacity allocated) at which time the application or the logging mechanism the application utilizes will provide a warning to the appropriate personnel.
 
-A failure of database auditing will result in either the database continuing to function without auditing, or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions. This can be an alert provided by a log repository or the OS when a designated log directory is nearing capacity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+A failure of database auditing will result in either the database continuing to function without auditing, or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions. This can be an alert provided by a log repository or the OS when a designated log directory is nearing capacity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Since SQL Server does not support the monitoring of the available audit log file space, utilize Windows File Server Resource Manager or a third-party application to perform this activity.
 
 From a Command Prompt, open fsrm.msc.
@@ -2074,88 +2078,88 @@ Expand Quota Management.
 Select Quotas.
 If Quotas have not been created for defined Audit Log storage locations that meet organizationally defined requirements, this is a finding.
 
-In the center pane, select each quota to determine its Path, Limit, Type, and Description. 
+In the center pane, select each quota to determine its Path, Limit, Type, and Description.
 
 Right click the appropriate quota or quotas, and click Edit Quota Properties.
 Examine the Notification thresholds panel. If there are no Notification thresholds applied to this Quota, this is a finding.
 If a Notification Threshold is applied, and it does not send an email alert, or provide an Event Log entry which is handled by an automated Log Alert reporting application, this is a finding.
 
-If a third-party application is utilized to fulfill this requirement, and it is not configured to provide a notification, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41025" severity="medium" conversionstatus="pass" title="SRG-APP-000071-DB-000047" dscresource="None">
+If a third-party application is utilized to fulfill this requirement, and it is not configured to provide a notification, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41025" severity="medium" conversionstatus="pass" title="SRG-APP-000071-DB-000047" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Configure SQL Server during the installation and/or configuration process to determine if adequate storage capacity has been allocated for audit logs.
 
 If SQL Server audit logs that are being generated exceed the amount of space reserved for those logs, the system may shutdown or take other measures to stop processing in order to protect transactions from continuing unlogged.
 
-After the initial setup of SQL Server audit log configuration, it is best to check the available space until the maximum number of files has been reached. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. Therefore, the combination of max_size and max_files must be monitored to ensure that overwriting does not occur. This must also coincide with the backup process of off-loading the files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Check the SQL Server audit setting on the maximum file size of the trace used for the auditing requirement. 
+After the initial setup of SQL Server audit log configuration, it is best to check the available space until the maximum number of files has been reached. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. Therefore, the combination of max_size and max_files must be monitored to ensure that overwriting does not occur. This must also coincide with the backup process of off-loading the files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Check the SQL Server audit setting on the maximum file size of the trace used for the auditing requirement.
 
-Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. 
+Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost.
 
 
-The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.   
-If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41026" severity="medium" conversionstatus="pass" title="SRG-APP-000072-DB-000046" dscresource="None">
+The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.
+If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41026" severity="medium" conversionstatus="pass" title="SRG-APP-000072-DB-000046" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server does not have the ability to be cognizant of potential audit log storage capacity issues. During the installation and/or configuration process, SQL Server should detect and determine if adequate storage capacity has been allocated for audit logs.
 
-During the installation process, a notification may be provided to the installer indicating, based on the auditing configuration chosen and the amount of storage space allocated for audit logs, the amount of storage capacity available is not sufficient to meet storage requirements. SQL Server is not able to send out notice based on adequate storage capacity allocated for the audit logs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+During the installation process, a notification may be provided to the installer indicating, based on the auditing configuration chosen and the amount of storage space allocated for audit logs, the amount of storage capacity available is not sufficient to meet storage requirements. SQL Server is not able to send out notice based on adequate storage capacity allocated for the audit logs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>From a Command Prompt, open fsrm.msc.
 If fsrm.msc is not installed, the File Server Resource Manager is not installed; File and Folder Quota Management is not enabled. If File Server Resource Manager or a third-party tool capable of sending alert notifications based on audit log store requirements is not installed, this is a finding.
 
 If fsrm.msc is installed, expand File Server Resource Manager in the left pane.
 Expand Quota Management.
 Expand Quotas.
-If Quotas have not been created for defined Audit Log storage locations, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41036" severity="medium" conversionstatus="pass" title="SRG-APP-999999-DB-000209" dscresource="None">
+If Quotas have not been created for defined Audit Log storage locations, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41036" severity="medium" conversionstatus="pass" title="SRG-APP-999999-DB-000209" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server Authentication does not provide for many of the authentication requirements of the DoD. In some cases workarounds are present, but the authentication is not as robust and does not provide needed functionality. Without that functionality, SQL Server is vulnerable to authentication attacks. Consideration must be given to the placement of SQL server inside a forest to ensure evaluation of risk within the environment is considered. Risk includes introduction of risk to SQL Server from other applications or workstations as well as risk from introduction of SQL server itself into an established environment.
 
-There may be situations where SQL Server Authentication must remain enabled, because of constraints imposed by a third-party application.  In such a case, document the constraint in the system security plan, and obtain signed approval.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+There may be situations where SQL Server Authentication must remain enabled, because of constraints imposed by a third-party application.  In such a case, document the constraint in the system security plan, and obtain signed approval.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>To determine the Server Authentication Mode, execute the following:
 
 EXEC XP_LOGINCONFIG 'login mode'
 
-If the config_value does not equal "Windows NT Authentication", this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41040" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000020" dscresource="None">
+If the config_value does not equal "Windows NT Authentication", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41040" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000020" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
 
 To limit exposure when operating from within a privileged account or role, the application must support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions.
 
 Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to misassignment of privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in, and provided by, applications.
 
-External applications called by SQL Server may be executed under OS or domain accounts with unnecessary privileges. This can lead to unauthorized access to OS resources and compromise of the OS, SQL Server, or any other services provided by the host platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+External applications called by SQL Server may be executed under OS or domain accounts with unnecessary privileges. This can lead to unauthorized access to OS resources and compromise of the OS, SQL Server, or any other services provided by the host platform.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Determine which OS or domain accounts are used by SQL Server to run external procedures. Validate that these accounts have only the privileges necessary to perform the required functionality.
 
-If any OS or domain accounts utilized by SQL Server are running external procedures and have privileges beyond those required for running the external procedures, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41043" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000017" dscresource="None">
+If any OS or domain accounts utilized by SQL Server are running external procedures and have privileges beyond those required for running the external procedures, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41043" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000017" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
 
 To limit exposure when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions.
 
-When privileged activities are not separated from non-privileged activities, SQL Server could be subject to unauthorized changes of settings or data, which a standard user would not normally have access to outside of an authorized maintenance session. Often, administrator accounts have a unique prefix to help with identification. These accounts are located within SQL Server and may only provide access to one database instance or a limited number of database objects.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+When privileged activities are not separated from non-privileged activities, SQL Server could be subject to unauthorized changes of settings or data, which a standard user would not normally have access to outside of an authorized maintenance session. Often, administrator accounts have a unique prefix to help with identification. These accounts are located within SQL Server and may only provide access to one database instance or a limited number of database objects.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain a list of SQL Server DBAs or other administrative accounts. Run the following SQL script to check all users’ permissions:
 
 SELECT SP1.[name] AS 'Login', 'Role: ' + SP2.[name] COLLATE DATABASE_DEFAULT AS 'ServerPermission'
@@ -2173,46 +2177,46 @@ ORDER BY [Login], [ServerPermission]
 
 If any DBA or administrative objects are owned by non-DBA or non-administrative accounts, this is a finding.
 
-If any DBA or administrator has authorization for non- administrative access to the system for which they are the administrator and they do not have a non-administrator account, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41045" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000012" dscresource="None">
+If any DBA or administrator has authorization for non- administrative access to the system for which they are the administrator and they do not have a non-administrator account, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41045" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000012" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems.
 
-Many sites distribute a single SQL Server connection configuration file to all site database users that contains network access information for all databases on the site. Such a file provides information to access SQL Server databases not required by all users that may assist in unauthorized access attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Check procedures for providing SQL Server database connection information to users/applications. If procedures do not indicate or implement restrictions to connections required by the particular user/application which indicate process of least privilege and specific authorization was employed, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41047" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000010" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. 
-
-The concept of separation of duties extends to processes.  The DBMS must run under a custom, dedicated OS or domain account.  When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions.  Similarly, related services must run under dedicated accounts where this is possible.  The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx  and  http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Many sites distribute a single SQL Server connection configuration file to all site database users that contains network access information for all databases on the site. Such a file provides information to access SQL Server databases not required by all users that may assist in unauthorized access attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Check procedures for providing SQL Server database connection information to users/applications. If procedures do not indicate or implement restrictions to connections required by the particular user/application which indicate process of least privilege and specific authorization was employed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41047" severity="medium" conversionstatus="pass" title="SRG-APP-000062-DB-000010" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action.
+
+The concept of separation of duties extends to processes.  The DBMS must run under a custom, dedicated OS or domain account.  When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions.  Similarly, related services must run under dedicated accounts where this is possible.  The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx  and  http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check OS settings to determine whether SQL Server processes are running under a dedicated OS or domain account. If the SQL Server processes are running under shared accounts, this is a finding.
 
 From a Command Prompt, type services.msc, and press [ENTER]. Scroll down to the SQL Server Services. SQL Server Services begin with SQL.  The following services, when present, should be listed as follows:
 
-Service Name:                    Log On As:
-SQL Full-text Filter Daemon Launcher:        NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server [stand-alone]:            NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server [cluster]:                &lt;domain&gt;\&lt;CustomServiceAccount&gt;
-SQL Server Agent:                NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Analysis Services:            NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Browser:                Local Service
-SQL Server Distributed Replay Client:        NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Distributed Replay Controller:    NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Integration Services 11.0:        NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server Reporting Services:            NT Service\UNIQUE CUSTOM ACCOUNT
-SQL Server VSS Writer:                Local System
-
-UNIQUE CUSTOM ACCOUNT refers to an account with which no other service listed in the services.msc window is assigned. If any account requiring a unique custom account uses an account that any other service utilizes (regardless of service status), this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41206" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+Service Name:     Log On As:
+SQL Full-text Filter Daemon Launcher:  NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server [stand-alone]:   NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server [cluster]:    &lt;domain&gt;\&lt;CustomServiceAccount&gt;
+SQL Server Agent:    NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Analysis Services:   NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Browser:    Local Service
+SQL Server Distributed Replay Client:  NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Distributed Replay Controller: NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Integration Services 11.0:  NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server Reporting Services:   NT Service\UNIQUE CUSTOM ACCOUNT
+SQL Server VSS Writer:    Local System
+
+UNIQUE CUSTOM ACCOUNT refers to an account with which no other service listed in the services.msc window is assigned. If any account requiring a unique custom account uses an account that any other service utilizes (regardless of service status), this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41206" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2221,25 +2225,25 @@ SQL Server's 'Unsafe assembly' permission is a high server-level privilege that
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Unsafe assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Unsafe assembly' 
+       what.permission_name = 'Unsafe assembly'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
@@ -2249,59 +2253,59 @@ GO
 If any role has 'Grant', 'With Grant' or 'Deny' privileges to the 'Unsafe assembly' permission and the role is not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41247" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. 
+GO</RawString>
+    </Rule>
+    <Rule id="V-41247" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
 
@@ -2311,25 +2315,25 @@ SQL Server's 'Alter any availability group' permission is a high server-level pr
 
 (The SQL Server installer gives this privilege to the system account "NT AUTHORITY\SYSTEM", so this account is excluded from the Check.  See article KB2847723 in the Microsoft knowledge base.)
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any availability group' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any availability group' 
+       what.permission_name = 'Alter any availability group'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -2340,59 +2344,59 @@ GO
 If any user accounts have direct access to the 'Alter any availability group' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41253" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41253" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2401,21 +2405,21 @@ SQL Server's 'Shutdown' permission is a high server-level privilege that must on
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the 'Shutdown' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -2424,63 +2428,63 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41254" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41254" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2489,86 +2493,86 @@ SQL Server's 'External access assembly' permission is a high server-level privil
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'External access assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'External access assembly' 
+       what.permission_name = 'External access assembly'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41255" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41255" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2577,21 +2581,21 @@ SQL Server's 'Create trace event notification' permission is a high server-level
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Create trace event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -2600,63 +2604,63 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41256" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41256" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2665,21 +2669,21 @@ SQL Server's 'Create server role' permission is a high server-level privilege th
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Create server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -2688,63 +2692,63 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41257" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41257" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2753,88 +2757,88 @@ SQL Server's 'Create endpoint' permission is a high server-level privilege that
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Create endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
 
 Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create endpoint' 
+       what.permission_name = 'Create endpoint'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41258" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41258" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2843,86 +2847,86 @@ SQL Server's 'Create DDL event notification' permission is a high server-level p
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Create DDL event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create DDL event notification' 
+       what.permission_name = 'Create DDL event notification'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41259" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41259" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -2931,86 +2935,86 @@ SQL Server's 'Create availability group' permission is a high server-level privi
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Create availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create availability group' 
+       what.permission_name = 'Create availability group'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41260" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41260" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3019,34 +3023,34 @@ SQL Server's 'Alter any server audit' permission is a high server-level privileg
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any server audit' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any server audit' 
+       what.permission_name = 'Alter any server audit'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
-If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41261" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41261" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3055,86 +3059,86 @@ SQL Server's 'View any definition' permission is a high server-level privilege t
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'View any definition' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'View any definition' 
+       what.permission_name = 'View any definition'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41269" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41269" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3143,23 +3147,23 @@ SQL Server's 'Administer bulk operations' permission is a high server-level priv
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Administer bulk operations' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
 
 Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -3168,63 +3172,63 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41270" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41270" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3233,86 +3237,86 @@ SQL Server's 'Alter resources' permission is a high server-level privilege that
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter resources' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter resources' 
+       what.permission_name = 'Alter resources'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41280" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41280" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3321,86 +3325,86 @@ SQL Server's 'Alter any availability group' permission is a high server-level pr
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any availability group' 
+       what.permission_name = 'Alter any availability group'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41281" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41281" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3409,86 +3413,86 @@ SQL Server's 'Alter any login' permission is a high server-level privilege that
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any login' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any login' 
+       what.permission_name = 'Alter any login'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41283" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41283" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3497,86 +3501,86 @@ SQL Server's 'Alter any linked server' permission is a high server-level privile
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any linked server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any linked server' 
+       what.permission_name = 'Alter any linked server'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41285" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41285" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3585,86 +3589,86 @@ SQL Server's 'View server state' permission is a high server-level privilege tha
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'View server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'View server state' 
+       what.permission_name = 'View server state'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41286" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41286" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3673,86 +3677,86 @@ SQL Server's 'Alter trace' permission is a high server-level privilege that must
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter trace' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter trace' 
+       what.permission_name = 'Alter trace'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41288" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41288" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3761,86 +3765,86 @@ SQL Server's 'Control server' permission is a high server-level privilege that m
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Control server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Control server' 
+       what.permission_name = 'Control server'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41290" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41290" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3849,21 +3853,21 @@ SQL Server's 'Alter any server role' permission is a high server-level privilege
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -3872,63 +3876,63 @@ AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41291" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41291" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -3937,86 +3941,86 @@ SQL Server's 'Alter Settings' permission is a high server-level privilege that m
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter Settings' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter Settings' 
+       what.permission_name = 'Alter Settings'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41292" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41292" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4025,86 +4029,86 @@ SQL Server's 'Authenticate server' permission is a high server-level privilege t
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Authenticate server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Authenticate server' 
+       what.permission_name = 'Authenticate server'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41293" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41293" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4113,86 +4117,86 @@ SQL Server's 'Create any database' permission is a high server-level privilege t
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Create any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create any database' 
+       what.permission_name = 'Create any database'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-    </Rule>
-    <Rule id="V-41297" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+GO</RawString>
+    </Rule>
+    <Rule id="V-41297" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4201,34 +4205,34 @@ SQL Server's 'Alter any connection' permission is a high server-level privilege
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any connection' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any connection' 
+       what.permission_name = 'Alter any connection'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
-If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41298" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41298" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4237,34 +4241,34 @@ SQL Server's 'Alter any credential' permission is a high server-level privilege
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any credential' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any credential' 
+       what.permission_name = 'Alter any credential'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
-If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41299" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41299" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4273,34 +4277,34 @@ SQL Server's 'Alter any database' permission is a high server-level privilege th
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any database' 
+       what.permission_name = 'Alter any database'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
-If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41300" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41300" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4309,34 +4313,34 @@ SQL Server's 'Alter any endpoint' permission is a high server-level privilege th
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any endpoint' 
+       what.permission_name = 'Alter any endpoint'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
-If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41302" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41302" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4345,34 +4349,34 @@ SQL Server's 'Alter any event session' permission is a high server-level privile
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any event session' 
+       what.permission_name = 'Alter any event session'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
-If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41303" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41303" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4381,65 +4385,65 @@ SQL Server's 'Alter server state' permission is a high server-level privilege th
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. 
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized.
 
 Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter server state' 
+       what.permission_name = 'Alter server state'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
-
-If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-41419" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+GO
+
+If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-41419" severity="medium" conversionstatus="pass" title="SRG-APP-000231-DB-000154" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan.
 
 If the procedures or evidence do not exist, this is a finding.
 
 If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding.
 
-If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-43196" severity="medium" conversionstatus="pass" title="SRG-APP-999999-DB-000209    " dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-43196" severity="medium" conversionstatus="pass" title="SRG-APP-999999-DB-000209    " dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Determine the accounts being used to manage the SQL Server operating system.  Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding.
 Note: If, because of the application configuration, there are multiple instances of SQL that would share a given exploit, a single account would be allowed to be used for the group and would not be considered a finding.
-</RawString>
-    </Rule>
-    <Rule id="V-54859" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Default database file locations should be protected from unauthorized access.  The system databases, essential to SQL Server operation, are typically located here.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+</RawString>
+    </Rule>
+    <Rule id="V-54859" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Default database file locations should be protected from unauthorized access.  The system databases, essential to SQL Server operation, are typically located here.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server default data directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location:
 HKEY_LOCAL_MACHINE
 &gt;&gt; SOFTWARE
@@ -4493,21 +4497,21 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 
 Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.
 
-Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents.  This is not a finding.</RawString>
-    </Rule>
-    <Rule id="V-54879" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Database files must be protected from unauthorized access.  Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents.  This is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-54879" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Database files must be protected from unauthorized access.  Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement:
-SELECT DISTINCT 
-LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 )) 
+SELECT DISTINCT
+LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 ))
 AS "Database Data File Paths",
 type_desc
 FROM sys.master_files
-WHERE database_id &gt; 4 
+WHERE database_id &gt; 4
 AND type = 0
 
 The query result is a list of file systems locations used for databases other than the system databases.  Navigate to each of those folder locations using a command prompt or Windows Explorer.  The following instructions assume that Windows Explorer is used.
@@ -4516,24 +4520,24 @@ The query result is a list of file systems locations used for databases other th
 Verify that the identified folders and their contents have only authorized privileges. Right-click each folder, click Properties. On the Security tab, verify that at most the following permissions are present:
 CREATOR OWNER (Full Control)
 System (Full control)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
 System Administrators (Full Control)  [Note 3]
 SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read &amp; Execute) [Notes 1, 2]
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
-SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]  
-If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-54881" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Backups must be protected from unauthorized deletion and modification.  They must also be protected from unauthorized use in database restoration.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: 
-HKEY_LOCAL_MACHINE 
-&gt;&gt; SOFTWARE 
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
+SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]
+If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-54881" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000207" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Backups must be protected from unauthorized deletion and modification.  They must also be protected from unauthorized use in database restoration.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location:
+HKEY_LOCAL_MACHINE
+&gt;&gt; SOFTWARE
 &gt;&gt; Microsoft
-&gt;&gt; Microsoft SQL Server 
+&gt;&gt; Microsoft SQL Server
 &gt;&gt; [INSTANCE NAME]
 &gt;&gt; MSSQLServer
 &gt;&gt; BackupDirectory
@@ -4547,9 +4551,9 @@ Navigate to each folder location using a command prompt or Windows Explorer.  Th
 Verify that backup files and folders have only authorized privileges. Right-click the backup folder, click Properties. On the Security tab, verify that at most the following permissions are present:
 CREATOR OWNER (Full Control)
 System (Full control)
-SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]  
-SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]  
-SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]  
+SQL Server Service SID OR Service Account (Full Control)  [Notes 1, 2]
+SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write)  [Notes 1, 2]
+SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use.  (Read, Write)  [Notes 1, 2]
 System Administrators (Full Control)  [Note 3]
 SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read &amp; Execute) [Notes 1, 2]
 If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.
@@ -4578,17 +4582,17 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l
 8) Click "OK"
 9) Permission like a normal user from here
 
-Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.</RawString>
-    </Rule>
-    <Rule id="V-59857" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000018" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Review procedures and practices.  If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding.  If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-59915" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
+Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.</RawString>
+    </Rule>
+    <Rule id="V-59857" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000018" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review procedures and practices.  If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding.  If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-59915" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -4597,11 +4601,11 @@ SQL Server's 'Alter any event notification' permission is a high server-level pr
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
 SELECT
@@ -4620,41 +4624,41 @@ AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
 who.name
 ;
-GO </RawString>
-    </Rule>
-  </ManualRule>
-  <PermissionRule dscresourcemodule="AccessControlDsc">
-    <Rule id="V-40950" severity="medium" conversionstatus="pass" title="SRG-APP-000130-DB-000088" dscresource="FileSystemAuditRuleEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Everyone</Principal>
-          <ForcePrincipal>
-          </ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>Traverse,ExecuteFile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. 
-
-Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. 
-
-Access restrictions for change also include software libraries. 
-
-Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover).  
-
-This requirement focuses on the auditing aspect of the protections.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>False</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>the correct path is specified and does NOT conflict with RuleId V-69169</OrganizationValueTestString>
-      <Path>
-      </Path>
+GO </RawString>
+    </Rule>
+  </ManualRule>
+  <PermissionRule dscresourcemodule="AccessControlDsc">
+    <Rule id="V-40950" severity="medium" conversionstatus="pass" title="SRG-APP-000130-DB-000088" dscresource="FileSystemAuditRuleEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Everyone</Principal>
+          <ForcePrincipal>
+          </ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>Traverse,ExecuteFile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
+
+Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
+
+Access restrictions for change also include software libraries.
+
+Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover).
+
+This requirement focuses on the auditing aspect of the protections.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Force>False</Force>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>the correct path is specified and does NOT conflict with RuleId V-69169</OrganizationValueTestString>
+      <Path>
+      </Path>
       <RawString>Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled.
 
-Right click the root folder of the SQL Server installation.  Typically, this is at &lt;drive&gt;:\Program Files\Microsoft SQL Server\.  Select Properties. 
+Right click the root folder of the SQL Server installation.  Typically, this is at &lt;drive&gt;:\Program Files\Microsoft SQL Server\.  Select Properties.
 
 Click on the Security tab
 
@@ -4669,7 +4673,7 @@ If "This folder, subfolders and files" is not listed in the "Apply To" column, t
 When "Everyone" ... " is listed, select the "Everyone" row and click on the Edit button.
 
 If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding:
-    Traverse folder/execute file 
+    Traverse folder/execute file
     List folder/read data
     Read attributes
     Read extended attributes
@@ -4678,32 +4682,32 @@ If either the Successful or Failed checkbox is not selected for any of the follo
     Write attributes
     Write extended attributes
     Delete
-    Read permissions</RawString>
-    </Rule>
-    <Rule id="V-69169" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="FileSystemAuditRuleEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Everyone</Principal>
-          <ForcePrincipal>
-          </ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-      </AccessControlEntry>
+    Read permissions</RawString>
+    </Rule>
+    <Rule id="V-69169" severity="medium" conversionstatus="pass" title="SRG-APP-000133-DB-000179" dscresource="FileSystemAuditRuleEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Everyone</Principal>
+          <ForcePrincipal>
+          </ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+      </AccessControlEntry>
       <Description>&lt;VulnDiscussion&gt;When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of applications and tools related to SQL Server can potentially have significant effects on the overall security of the system. Only qualified and authorized individuals shall be allowed to obtain access to components related to SQL Server for purposes of initiating changes, including upgrades and modifications.
 
 Unmanaged changes that occur to the software libraries or configuration can lead to unauthorized or compromised installations.
 
-Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and audited.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>False</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>the correct path is specified and does NOT conflict with RuleId V-40950</OrganizationValueTestString>
-      <Path>
-      </Path>
+Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and audited.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Force>False</Force>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>the correct path is specified and does NOT conflict with RuleId V-40950</OrganizationValueTestString>
+      <Path>
+      </Path>
       <RawString>Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location:
 HKEY_LOCAL_MACHINE
 &gt;&gt; SOFTWARE
@@ -4715,119 +4719,119 @@ HKEY_LOCAL_MACHINE
 
 Determine the location of separate but related softare, such as audit file management tools.
 
-Verify that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, verify 
+Verify that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, verify
 that the following is set up on at least one audit:
 Type: All
 Principal: Everyone
 Access: Modify
 Applies to: This Folder, subfolder, and files [where applicable]
 
-If the required audit settings are not configured, there is a risk that unauthorized changes to the software will go undetected, and this is a finding.</RawString>
-    </Rule>
-  </PermissionRule>
-  <SqlScriptQueryRule dscresourcemodule="SqlServerDsc">
-    <Rule id="V-40936" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000092" dscresource="SqlScriptQuery">
+If the required audit settings are not configured, there is a risk that unauthorized changes to the software will go undetected, and this is a finding.</RawString>
+    </Rule>
+  </PermissionRule>
+  <SqlScriptQueryRule dscresourcemodule="SqlServerDsc">
+    <Rule id="V-40936" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000092" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;SQL Server's 'sa' account has special privileges required to administer the database. The 'sa' account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database.
 
 This 'sa' default account is administrative and could lead to catastrophic consequences, including the complete loss of control over SQL Server.
 
 If the 'sa' default account is not disabled, an attacker might be able to gain access through the account. SQL Server by default, at installation, disables the 'sa' account.
 
-Some applications that run on SQL Server require the 'sa' account to be enabled in order for the application to function properly. These applications that require the 'sa' account to be enabled are usually legacy systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled &lt;&gt; 1;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Some applications that run on SQL Server require the 'sa' account to be enabled in order for the application to function properly. These applications that require the 'sa' account to be enabled are usually legacy systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled &lt;&gt; 1;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check SQL Server settings to determine if the 'sa' (sysadmin) account has been disabled by executing the following query:
 
 USE MASTER
 GO
-SELECT name, is_disabled 
-FROM sys.sql_logins 
+SELECT name, is_disabled
+FROM sys.sql_logins
 WHERE principal_id = 1;
 
 Verify that the "name" column contains the current name of the sa database server account (see note).
 
 If the "is_disabled" column is not set to 1, this is a finding.
 
-Note:  If the 'sa' account name has been changed per SQL2-00-010200, its new name should appear in the query results.</RawString>
-      <SetScript>USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled &lt;&gt; 1 exec sp_executeSQL @cmd;</SetScript>
-      <TestScript>USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled &lt;&gt; 1;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-40942" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000090" dscresource="SqlScriptQuery">
+Note:  If the 'sa' account name has been changed per SQL2-00-010200, its new name should appear in the query results.</RawString>
+      <SetScript>USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled &lt;&gt; 1 exec sp_executeSQL @cmd;</SetScript>
+      <TestScript>USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled &lt;&gt; 1;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-40942" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000090" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements and providing a wide array of functionality not required for every mission, but which cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities. Even though the very popular "AdventureWorks" database is no longer available by default, it introduces a vulnerability to SQL Server and must be removed.
 
-Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT name from sysdatabases where name like 'AdventureWorks%';</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT name from sysdatabases where name like 'AdventureWorks%';</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check SQL Server for the existence of the publicly available "AdventureWorks" database by performing the following query:
 
 SELECT name from sysdatabases where name like 'AdventureWorks%';
 
-If the "AdventureWorks" database is present, this is a finding.</RawString>
-      <SetScript>DROP DATABASE AdventureWorks</SetScript>
-      <TestScript>SELECT name from sysdatabases where name like 'AdventureWorks%';</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-40943" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000090" dscresource="SqlScriptQuery">
+If the "AdventureWorks" database is present, this is a finding.</RawString>
+      <SetScript>DROP DATABASE AdventureWorks</SetScript>
+      <TestScript>SELECT name from sysdatabases where name like 'AdventureWorks%';</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-40943" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000090" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
 
 It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements and providing a wide array of functionality not required for every mission, but which cannot be disabled.
 
 Applications must adhere to the principles of least functionality by providing only essential capabilities. Even though the very popular "NorthWind" database is no longer available by default, it introduces a vulnerability to SQL Server and must be removed.
 
-Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT name from sysdatabases where name like 'Northwind%';</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT name from sysdatabases where name like 'Northwind%';</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check SQL Server for the existence of the publicly available "NorthWind" database by performing the following query:
 
 SELECT name from sysdatabases where name like 'Northwind%';
 
-If the "Northwind" database is present, this is a finding.</RawString>
-      <SetScript>DROP DATABASE Northwind</SetScript>
-      <TestScript>SELECT name from sysdatabases where name like 'Northwind%';</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41021" severity="medium" conversionstatus="pass" title="SRG-APP-000115-DB-000056" dscresource="SqlScriptQuery">
+If the "Northwind" database is present, this is a finding.</RawString>
+      <SetScript>DROP DATABASE Northwind</SetScript>
+      <TestScript>SELECT name from sysdatabases where name like 'Northwind%';</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41021" severity="medium" conversionstatus="pass" title="SRG-APP-000115-DB-000056" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
-Detection of suspicious activity, including access attempts and successful access from unexpected places, during unexpected times, or other unusual indicators, can support decisions to apply countermeasures to deter an attack. Without detection, malicious activity may proceed without hindrance. In SQL Server's case, this is a combination of the standard audit trace, as well as the operating system logs. Only the SQL Server logs are validated for this check, as the other part is dependent upon the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Detection of suspicious activity, including access attempts and successful access from unexpected places, during unexpected times, or other unusual indicators, can support decisions to apply countermeasures to deter an attack. Without detection, malicious activity may proceed without hindrance. In SQL Server's case, this is a combination of the standard audit trace, as well as the operating system logs. Only the SQL Server logs are validated for this check, as the other part is dependent upon the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -4835,29 +4839,29 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41022" severity="medium" conversionstatus="pass" title="SRG-APP-000107-DB-000169" dscresource="SqlScriptQuery">
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41022" severity="medium" conversionstatus="pass" title="SRG-APP-000107-DB-000169" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;It is critical that, when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. If the system were to continue processing without auditing enabled, actions could be taken on the system that could not be tracked and recorded for later forensic analysis.
 
 In many system configurations, the disk space allocated to the auditing system is separate from the disks allocated for the operating system; therefore, this may not result in a system outage. This places the onus on the DBMS to detect and take actions.
 
 A failure of SQL Server auditing will result in either the database continuing to function without auditing, or the halting of SQL Server operations. In this case, the database must cease processing immediately in order to not allow unlogged transaction to occur.
 
-Note that trace file rollover does not count as an audit failure, provided that the system is also configured to shut down when it runs out of space.  Trace file rollover can be a useful technique for breaking the log into manageable pieces, for archiving, or for transfer to a log management system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT * FROM ::fn_trace_getinfo(NULL)</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that trace file rollover does not count as an audit failure, provided that the system is also configured to shut down when it runs out of space.  Trace file rollover can be a useful technique for breaking the log into manageable pieces, for archiving, or for transfer to a log management system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT * FROM ::fn_trace_getinfo(NULL)</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>From the query prompt:
 
 SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
@@ -4867,7 +4871,7 @@ All currently defined traces for the SQL Server instance will be listed. If no t
 Determine the trace being used for the auditing requirement. Replace # in the following code with a traceid being used for the auditing requirements.
 
 From the query prompt, determine whether the trace options include the value 4, which means SHUTDOWN_ON_ERROR:
-SELECT CAST(value AS INT) 
+SELECT CAST(value AS INT)
 FROM sys.fn_trace_getinfo(#)
 where property = 1;
 
@@ -4877,71 +4881,71 @@ If a value is returned but is not 4 or 6, this is a finding.
 
 
 NOTE:  Microsoft has flagged the trace techniques and tools used in this STIG as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use and configured to satisfy this requirement, this is not a finding.  The following code can be used to check Extended Events settings.
-/********************************** 
+/**********************************
 Check to verify shutdown on failure is set.
-The following settings are what should be returned: 
-name = &lt;name of audit&gt; 
-on_failure = 1 
-on_failure_desc = SHUTDOWN SERVER INSTANCE 
-**********************************/ 
-SELECT name, on_failure, on_failure_desc 
-FROM sys.server_audits 
-</RawString>
-      <SetScript>DECLARE @new_trace_id INT; DECLARE @traceid INT; SET @traceId  = (SELECT traceId FROM ::fn_trace_getinfo(NULL) WHERE Value = 6) EXECUTE master.dbo.sp_trace_create     @results = @new_trace_id OUTPUT,     @options = 6,     @traceFilePath = N'$(TraceFilePath)'</SetScript>
-      <TestScript>DECLARE @traceId int SET @traceId = (SELECT traceId FROM ::fn_trace_getinfo(NULL) WHERE Value = 6) IF (@traceId IS NULL) SELECT traceId FROM ::fn_trace_getinfo(NULL) ELSE Print NULL</TestScript>
-      <Variable>TraceFilePath={0}</Variable>
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41024" severity="medium" conversionstatus="pass" title="SRG-APP-000071-DB-000047" dscresource="SqlScriptQuery">
+The following settings are what should be returned:
+name = &lt;name of audit&gt;
+on_failure = 1
+on_failure_desc = SHUTDOWN SERVER INSTANCE
+**********************************/
+SELECT name, on_failure, on_failure_desc
+FROM sys.server_audits
+</RawString>
+      <SetScript>DECLARE @new_trace_id INT; DECLARE @traceid INT; SET @traceId  = (SELECT traceId FROM ::fn_trace_getinfo(NULL) WHERE Value = 6) EXECUTE master.dbo.sp_trace_create     @results = @new_trace_id OUTPUT,     @options = 6,     @traceFilePath = N'$(TraceFilePath)'</SetScript>
+      <TestScript>DECLARE @traceId int SET @traceId = (SELECT traceId FROM ::fn_trace_getinfo(NULL) WHERE Value = 6) IF (@traceId IS NULL) SELECT traceId FROM ::fn_trace_getinfo(NULL) ELSE Print NULL</TestScript>
+      <Variable>TraceFilePath={0}</Variable>
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41024" severity="medium" conversionstatus="pass" title="SRG-APP-000071-DB-000047" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;Configure SQL Server during the installation and/or configuration process to determine if adequate storage capacity has been allocated for audit logs.
 
 If SQL Server audit logs that are being generated exceed the amount of space reserved for those logs, the system may shutdown or take other measures to stop processing in order to protect transactions from continuing unlogged.
 
-After the initial setup of SQL Server audit log configuration, it is best to check the available space frequently until the maximum number of files has been reached. Checking the available space can help determine the balance of online audit data with space required.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT * FROM ::fn_trace_getinfo(NULL)</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Check the SQL Server audit setting on the maximum number of files of the trace used for the auditing requirement. 
-
-Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. 
-
-
-The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.   
-If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.</RawString>
-      <SetScript>DECLARE @new_trace_id INT; DECLARE @maxsize bigint DECLARE @maxRolloverFiles int DECLARE @traceId int DECLARE @traceFilePath nvarchar(500) SET @traceFilePath = N'$(TraceFilePath)' SET @traceId = (Select Id from sys.traces where path LIKE (@traceFilePath + '%')) SET @maxsize = $(MaxTraceFileSize) SET @maxRolloverFiles = $(MaxRollOverFileCount) EXEC sp_trace_setstatus @traceid, @status = 2 EXECUTE master.dbo.sp_trace_create     @new_trace_id OUTPUT,     6,     @traceFilePath,     @maxsize,     NULL,     @maxRolloverFiles </SetScript>
-      <TestScript>DECLARE @traceFilePath nvarchar(500) DECLARE @desiredFileSize bigint DECLARE @desiredMaxFiles int DECLARE @currentFileSize bigint DECLARE @currentMaxFiles int SET @traceFilePath = N'$(TraceFilePath)' SET @currentFileSize = (SELECT max_size from sys.traces where path LIKE (@traceFilePath + '%')) SET @currentMaxFiles = (SELECT max_files from sys.traces where path LIKE (@traceFilePath + '%')) IF (@currentFileSize != $(MaxTraceFileSize)) BEGIN PRINT 'file size not in desired state' SELECT max_size from sys.traces where path LIKE (@traceFilePath + '%') END IF (@currentMaxFiles != $(MaxRollOverFileCount)) BEGIN PRINT 'max files not in desired state'SELECT max_files from sys.traces where path LIKE (@traceFilePath + '%') END</TestScript>
-      <Variable>TraceFilePath={0} MaxRollOverFileCount={1} MaxTraceFileSize={2}</Variable>
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41027" severity="medium" conversionstatus="pass" title="SRG-APP-000101-DB-000044" dscresource="None">
+After the initial setup of SQL Server audit log configuration, it is best to check the available space frequently until the maximum number of files has been reached. Checking the available space can help determine the balance of online audit data with space required.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT * FROM ::fn_trace_getinfo(NULL)</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Check the SQL Server audit setting on the maximum number of files of the trace used for the auditing requirement.
+
+Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost.
+
+
+The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size.
+If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.</RawString>
+      <SetScript>DECLARE @new_trace_id INT; DECLARE @maxsize bigint DECLARE @maxRolloverFiles int DECLARE @traceId int DECLARE @traceFilePath nvarchar(500) SET @traceFilePath = N'$(TraceFilePath)' SET @traceId = (Select Id from sys.traces where path LIKE (@traceFilePath + '%')) SET @maxsize = $(MaxTraceFileSize) SET @maxRolloverFiles = $(MaxRollOverFileCount) EXEC sp_trace_setstatus @traceid, @status = 2 EXECUTE master.dbo.sp_trace_create     @new_trace_id OUTPUT,     6,     @traceFilePath,     @maxsize,     NULL,     @maxRolloverFiles </SetScript>
+      <TestScript>DECLARE @traceFilePath nvarchar(500) DECLARE @desiredFileSize bigint DECLARE @desiredMaxFiles int DECLARE @currentFileSize bigint DECLARE @currentMaxFiles int SET @traceFilePath = N'$(TraceFilePath)' SET @currentFileSize = (SELECT max_size from sys.traces where path LIKE (@traceFilePath + '%')) SET @currentMaxFiles = (SELECT max_files from sys.traces where path LIKE (@traceFilePath + '%')) IF (@currentFileSize != $(MaxTraceFileSize)) BEGIN PRINT 'file size not in desired state' SELECT max_size from sys.traces where path LIKE (@traceFilePath + '%') END IF (@currentMaxFiles != $(MaxRollOverFileCount)) BEGIN PRINT 'max files not in desired state'SELECT max_files from sys.traces where path LIKE (@traceFilePath + '%') END</TestScript>
+      <Variable>TraceFilePath={0} MaxRollOverFileCount={1} MaxTraceFileSize={2}</Variable>
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41027" severity="medium" conversionstatus="pass" title="SRG-APP-000101-DB-000044" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;SQL Server auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server does have a means available to add organizationally defined additional, more detailed information in the audit event records. These events may be identified by type, location, or subject. An example of more detailed information the organization may require in audit records could be the name of the application where the request is coming from.
 
-Some organizations may determine that more detailed information is required for specific database event types. If this information is not available, it could negatively impact forensic investigations into user actions or other malicious events.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Some organizations may determine that more detailed information is required for specific database event types. If this information is not available, it could negatively impact forensic investigations into user actions or other malicious events.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -4949,41 +4953,41 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41028" severity="medium" conversionstatus="pass" title="SRG-APP-000100-DB-000201" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
-
-Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41028" severity="medium" conversionstatus="pass" title="SRG-APP-000100-DB-000201" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
+
+Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -4991,45 +4995,45 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41029" severity="medium" conversionstatus="pass" title="SRG-APP-000099-DB-000043" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41029" severity="medium" conversionstatus="pass" title="SRG-APP-000099-DB-000043" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know the outcome of attempted actions. This requires specific information regarding the outcome of the action or event that the audit record is referring to. If outcome status information is not recorded and stored with the audit record, the record itself is of very limited use.
 
 Success and failure indicators ascertain the outcome of a particular event. As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Without knowing the outcome of audit events, it is very difficult to accurately recreate the series of events during forensic analysis.
 
-If auditing is enabled, SQL Server does capture the outcome status-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If auditing is enabled, SQL Server does capture the outcome status-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -5037,43 +5041,43 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41030" severity="medium" conversionstatus="pass" title="SRG-APP-000098-DB-000042" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41030" severity="medium" conversionstatus="pass" title="SRG-APP-000098-DB-000042" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed what actions. This requires specific information regarding the source of the event an audit record is referring to. If the source of the event information is not recorded and stored with the audit record, the record itself is of very limited use.
 
-The source of the event can be a user account and sometimes a system account when timed jobs are run. Without information establishing the source of activity, the value of audit records from a forensics perspective is questionable. If auditing is enabled, SQL Server does capture the source of the event-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The source of the event can be a user account and sometimes a system account when timed jobs are run. Without information establishing the source of activity, the value of audit records from a forensics perspective is questionable. If auditing is enabled, SQL Server does capture the source of the event-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -5081,43 +5085,43 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41031" severity="medium" conversionstatus="pass" title="SRG-APP-000097-DB-000041" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41031" severity="medium" conversionstatus="pass" title="SRG-APP-000097-DB-000041" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly where actions were performed. This requires specific information regarding the event location an audit record is referring to. If event location information is not recorded and stored with the audit record, the record itself is of very limited use.
 
-An event location can be a database instance, table, column, row, etc. Without sufficient information establishing where the audit events occurred, investigation into the cause of events is severely hindered. If auditing is enabled, SQL Server does capture the event location-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+An event location can be a database instance, table, column, row, etc. Without sufficient information establishing where the audit events occurred, investigation into the cause of events is severely hindered. If auditing is enabled, SQL Server does capture the event location-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -5125,43 +5129,43 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41032" severity="medium" conversionstatus="pass" title="SRG-APP-000096-DB-000040" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41032" severity="medium" conversionstatus="pass" title="SRG-APP-000096-DB-000040" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly when actions were performed. This requires specific information regarding the date and time an audit record is referring to. If date and time information is not recorded and stored with the audit record, the record itself is of very limited use.
 
-If auditing is enabled, SQL Server does capture the date and time-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If auditing is enabled, SQL Server does capture the date and time-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -5169,43 +5173,43 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41033" severity="medium" conversionstatus="pass" title="SRG-APP-000095-DB-000039" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41033" severity="medium" conversionstatus="pass" title="SRG-APP-000095-DB-000039" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to:  time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.
 
 SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly what actions were performed. This requires specific information regarding the event type an audit record is referring to. If event type information is not recorded and stored with the audit record, the record itself is of very limited use.
 
-If auditing is enabled, SQL Server does capture the event type-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If auditing is enabled, SQL Server does capture the event type-specific information in all audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -5213,45 +5217,45 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41035" severity="medium" conversionstatus="pass" title="SRG-APP-000091-DB-000066" dscresource="None">
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41035" severity="medium" conversionstatus="pass" title="SRG-APP-000091-DB-000066" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Audit records can be generated from various components within the information system, such as network interfaces, hard disks, modems, etc. From an application perspective, certain specific application functionalities may be audited, as well.
 
 The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records (i.e., auditable events, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked).
 
 Organizations may define the organizational personnel accountable for determining which application components shall provide auditable events.
 
-Auditing provides accountability for changes made to the SQL Server configuration or its objects and data. It provides a means to discover suspicious activity and unauthorized changes. Without auditing, a compromise may go undetected and without a means to determine accountability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Auditing provides accountability for changes made to the SQL Server configuration or its objects and data. It provides a means to discover suspicious activity and unauthorized changes. Without auditing, a compromise may go undetected and without a means to determine accountability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -5259,42 +5263,42 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41037" severity="low" conversionstatus="pass" title="SRG-APP-000063-DB-000023" dscresource="SqlScriptQuery">
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41037" severity="low" conversionstatus="pass" title="SRG-APP-000063-DB-000023" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;SQL Server's 'sa' account has special privileges required to administer the database. The 'sa' account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database.
 
-Since the SQL Server 'sa' is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the 'sa' account name.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT name FROM sys.server_principals WHERE TYPE = 'S' and name not like '%##%'</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Since the SQL Server 'sa' is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the 'sa' account name.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT name FROM sys.server_principals WHERE TYPE = 'S' and name not like '%##%'</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Verify the SQL Server default 'sa' account name has been changed.
 
 Navigate to SQL Server Management Studio &gt;&gt; Object Explorer &gt;&gt; &lt;'SQL Server name'&gt; &gt;&gt; Security &gt;&gt; Logins.
 
-If SQL Server default 'sa' account name is in the 'Logins' list, this is a finding.</RawString>
-      <SetScript>alter login sa with name = [$(saAccountName)]</SetScript>
-      <TestScript>SELECT name FROM sys.server_principals WHERE TYPE = 'S' and name = 'sa'</TestScript>
-      <Variable>saAccountName={0}</Variable>
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41042" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000018" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;This is intended to limit exposure, by making it possible to trace any unauthorized access to other data or functionality by a privileged user account or role that has permissions on security functions or security-relevant information.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+If SQL Server default 'sa' account name is in the 'Logins' list, this is a finding.</RawString>
+      <SetScript>alter login sa with name = [$(saAccountName)]</SetScript>
+      <TestScript>SELECT name FROM sys.server_principals WHERE TYPE = 'S' and name = 'sa'</TestScript>
+      <Variable>saAccountName={0}</Variable>
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41042" severity="medium" conversionstatus="pass" title="SRG-APP-000063-DB-000018" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;This is intended to limit exposure, by making it possible to trace any unauthorized access to other data or functionality by a privileged user account or role that has permissions on security functions or security-relevant information.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
 
@@ -5326,13 +5330,13 @@ Notes:
 Use the following query to obtain a list of all event IDs, and their meaning:
 SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41207" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41207" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -5341,26 +5345,26 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts. If administrative user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any endpoint' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any endpoint' 
+       what.permission_name = 'Alter any endpoint'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -5371,63 +5375,63 @@ GO
 If any user accounts have direct access to the 'Alter any endpoint' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any endpoint' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41208" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any endpoint' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41208" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -5436,26 +5440,26 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any database' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any database' 
+       what.permission_name = 'Alter any database'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -5466,63 +5470,63 @@ GO
 If any user accounts have direct access to the 'Alter any database' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any database' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41209" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any database' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41209" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -5531,26 +5535,26 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any credential' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any credential' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any credential' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any credential' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any credential' 
+       what.permission_name = 'Alter any credential'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -5561,63 +5565,63 @@ GO
 If any user accounts have direct access to the 'Alter any credential' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any credential' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any credential' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41246" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any credential' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any credential' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41246" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -5626,26 +5630,26 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any connection' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any connection' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any connection' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any connection' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any connection' 
+       what.permission_name = 'Alter any connection'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -5656,63 +5660,63 @@ GO
 If any user accounts have direct access to the 'Alter any connection' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any connection' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any connection' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41248" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any connection' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any connection' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41248" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -5721,22 +5725,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter server state' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -5751,63 +5755,63 @@ GO
 If any user accounts have direct access to the 'Alter server state' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter server state' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41250" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter server state' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41250" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -5816,22 +5820,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any event notification' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -5846,63 +5850,63 @@ GO
 If any user accounts have direct access to the 'Alter any event notification' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any event notification' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41251" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any event notification' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41251" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -5911,91 +5915,91 @@ SQL Server's 'View any database' permission is a high server-level privilege tha
 
 Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role.
 
-The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any database' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString />
+The fix for this vulnerability specifies the use of REVOKE.  Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission.  If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any database' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of roles that are authorized for the SQL Server 'View any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'View any database' 
+       what.permission_name = 'View any database'
 AND    who.type_desc = 'SERVER_ROLE'
 ORDER BY
        who.name
 ;
-GO 
+GO
 
 If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
-AND    who.type_desc = 'SERVER_ROLE'
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
+AND who.type_desc = 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>REVOKE External access assembly TO '$(ViewAnyDbUser)'</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any database' AND who.type_desc = 'SERVER_ROLE' AND who.name != '$(ViewAnyDbUser)' ORDER BY who.name</TestScript>
-      <Variable>ViewAnyDbUser={0}</Variable>
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41252" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>REVOKE External access assembly TO '$(ViewAnyDbUser)'</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any database' AND who.type_desc = 'SERVER_ROLE' AND who.name != '$(ViewAnyDbUser)' ORDER BY who.name</TestScript>
+      <Variable>ViewAnyDbUser={0}</Variable>
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41252" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6004,26 +6008,26 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any server audit' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server audit' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server audit' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any server audit' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Alter any server audit' 
+       what.permission_name = 'Alter any server audit'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -6034,63 +6038,63 @@ GO
 If any user accounts have direct access to the 'Alter any server audit' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any server audit' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server audit' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41262" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any server audit' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server audit' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41262" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6099,22 +6103,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Authenticate Server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'AUTHENTICATE SERVER' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'AUTHENTICATE SERVER' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Authenticate Server' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6129,63 +6133,63 @@ GO
 If any user accounts have direct access to the 'Authenticate Server' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'AUTHENTICATE SERVER' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'AUTHENTICATE SERVER' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41263" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'AUTHENTICATE SERVER' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'AUTHENTICATE SERVER' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41263" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6194,22 +6198,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Administer bulk operations' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Administer bulk operations' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Administer bulk operations' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Administer bulk operations' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6224,63 +6228,63 @@ GO
 If any user accounts have direct access to the 'Administer bulk operations' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Administer bulk operations' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Administer bulk operations' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41264" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Administer bulk operations' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Administer bulk operations' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41264" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6289,22 +6293,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Create endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Create endpoint' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6319,63 +6323,63 @@ GO
 If any user accounts have direct access to the 'Create endpoint' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create endpoint' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41265" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create endpoint' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create endpoint' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41265" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6384,12 +6388,12 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Create DDL event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create DDL Event Notification' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create DDL Event Notification' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Create DDL Event Notification' by running the following query:
 
 SELECT
@@ -6403,7 +6407,7 @@ sys.server_permissions what
 INNER JOIN sys.server_principals who
 ON who.principal_id = what.grantee_principal_id
 WHERE
-what.permission_name = 'Create DDL Event Notification' 
+what.permission_name = 'Create DDL Event Notification'
 AND who.name NOT LIKE '##MS%##'
 AND who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -6414,63 +6418,63 @@ GO
 If any user accounts have direct access to the 'Create DDL Event Notification' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create DDL Event Notification' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create DDL Event Notification' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41266" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create DDL Event Notification' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create DDL Event Notification' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41266" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6480,22 +6484,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 SQL Server's 'Create availability group' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
 Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.
-&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create availability group' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create availability group' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Create availability group' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6510,63 +6514,63 @@ GO
 If any user accounts have direct access to the 'Create availability group' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create availability group' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create availability group' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41267" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create availability group' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create availability group' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41267" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6575,22 +6579,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Create any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Create any database' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6605,63 +6609,63 @@ GO
 If any user accounts have direct access to the 'Create any database' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create any database' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41268" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create any database' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create any database' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41268" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6670,22 +6674,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Control server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Control server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Control server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Control server' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6700,63 +6704,63 @@ GO
 If any user accounts have direct access to the 'Control server' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Control server' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Control server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41271" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Control server' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Control server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41271" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6765,22 +6769,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any linked server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any linked server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any linked server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any linked server' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6795,63 +6799,63 @@ GO
 If any user accounts have direct access to the 'Alter any linked server' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any linked server' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any linked server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41273" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any linked server' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any linked server' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41273" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6860,22 +6864,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any event session' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event session' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event session' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any event session' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6890,63 +6894,63 @@ GO
 If any user accounts have direct access to the 'Alter any event session' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any event session' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event session' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41274" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any event session' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any event session' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41274" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -6955,22 +6959,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter trace' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter trace' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter trace' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter trace' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -6985,63 +6989,63 @@ GO
 If any user accounts have direct access to the 'Alter trace' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter trace' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter trace' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41275" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter trace' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter trace' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41275" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7050,22 +7054,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter Settings' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter Settings' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter Settings' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter Settings' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7080,63 +7084,63 @@ GO
 If any user accounts have direct access to the 'Alter Settings' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter Settings' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter Settings' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41276" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter Settings' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter Settings' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41276" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7145,26 +7149,26 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Create trace event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create trace event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create trace event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Create trace event notification' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Create trace event notification' 
+       what.permission_name = 'Create trace event notification'
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -7175,63 +7179,63 @@ GO
 If any user accounts have direct access to the 'Create trace event notification' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create trace event notification' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create trace event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41277" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create trace event notification' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create trace event notification' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41277" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7240,22 +7244,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter resources' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter resources' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter resources' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter resources' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7270,63 +7274,63 @@ GO
 If any user accounts have direct access to the 'Alter resources' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter resources' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter resources' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41278" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter resources' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter resources' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41278" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7335,22 +7339,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'External access assembly' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'External access assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'External access assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'External access assembly' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7365,63 +7369,63 @@ GO
 If any user accounts have direct access to the 'External access assembly' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'External access assembly' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'External access assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41279" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'External access assembly' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'External access assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41279" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7430,22 +7434,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any login' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any login' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any login' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any login' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7460,63 +7464,63 @@ GO
 If any user accounts have direct access to the 'Alter any login' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any login' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any login' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41284" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any login' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any login' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41284" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7525,26 +7529,26 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Shutdown' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts. If administrative user accounts have direct access to administrative roles, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Shutdown' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Shutdown' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Shutdown' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
-       what.permission_name = 'Shutdown' 
+       what.permission_name = 'Shutdown'
 AND who.name NOT LIKE '##MS%##'
 AND who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -7555,63 +7559,63 @@ GO
 If any user accounts have direct access to the 'Shutdown' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Shutdown' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Shutdown' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41287" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Shutdown' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Shutdown' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41287" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7620,22 +7624,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Unsafe assembly' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Unsafe assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Unsafe assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Unsafe assembly' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7650,63 +7654,63 @@ GO
 If any user accounts have direct access to the 'Unsafe assembly' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Unsafe assembly' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Unsafe assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41289" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Unsafe assembly' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Unsafe assembly' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41289" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7715,22 +7719,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Create server role' permission is a high server-level privilege that must only be granted to individual administration accounts through roles.  This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Create server role' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7745,63 +7749,63 @@ GO
 If any user accounts have direct access to the 'Create server role' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create server role' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41294" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Create server role' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Create server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41294" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7810,22 +7814,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'View server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'View server state' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7840,63 +7844,63 @@ GO
 If any user account has direct access to the 'View server state' permission, and the need for this has not been documented and approved, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'View server state' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41295" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'View server state' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View server state' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41295" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -7905,22 +7909,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'Alter any server role' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'Alter any server role' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -7935,63 +7939,63 @@ GO
 If any user accounts have direct access to the 'Alter any server role' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any server role' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41296" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'Alter any server role' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'Alter any server role' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41296" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -8000,22 +8004,22 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'View any definition' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any definition' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'.  These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any definition' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'View any definition' by running the following query:
 
-SELECT 
+SELECT
        who.name AS [Principal Name],
        who.type_desc AS [Principal Type],
        who.is_disabled AS [Principal Is Disabled],
        what.state_desc AS [Permission State],
        what.permission_name AS [Permission Name]
-FROM 
-       sys.server_permissions what 
+FROM
+       sys.server_permissions what
        INNER JOIN sys.server_principals who
               ON who.principal_id = what.grantee_principal_id
 WHERE
@@ -8030,89 +8034,89 @@ GO
 If any user accounts have direct access to the 'View any definition' permission, this is a finding.
 
 Alternatively, to provide a combined list for all requirements of this type:
-SELECT 
-    what.permission_name AS [Permission Name],
-    what.state_desc AS [Permission State],
-    who.name AS [Principal Name],
-    who.type_desc AS [Principal Type],
-    who.is_disabled AS [Principal Is Disabled]
-FROM 
-    sys.server_permissions what 
-    INNER JOIN sys.server_principals who
-        ON who.principal_id = what.grantee_principal_id
+SELECT
+ what.permission_name AS [Permission Name],
+ what.state_desc AS [Permission State],
+ who.name AS [Principal Name],
+ who.type_desc AS [Principal Type],
+ who.is_disabled AS [Principal Is Disabled]
+FROM
+ sys.server_permissions what
+ INNER JOIN sys.server_principals who
+  ON who.principal_id = what.grantee_principal_id
 WHERE
-    what.permission_name IN
-    (
-    'Administer bulk operations',
-    'Alter any availability group',
-    'Alter any connection',
-    'Alter any credential',
-    'Alter any database',
-    'Alter any endpoint ',
-    'Alter any event notification ',
-    'Alter any event session ',
-    'Alter any linked server',
-    'Alter any login',
-    'Alter any server audit',
-    'Alter any server role',
-    'Alter resources',
-    'Alter server state ',
-    'Alter Settings ',
-    'Alter trace',
-    'Authenticate server ',
-    'Control server',
-    'Create any database ',
-    'Create availability group',
-    'Create DDL event notification',
-    'Create endpoint',
-    'Create server role',
-    'Create trace event notification',
-    'External access assembly',
-    'Shutdown',
-    'Unsafe Assembly',
-    'View any database',
-    'View any definition',
-    'View server state'
-    )
+ what.permission_name IN
+ (
+ 'Administer bulk operations',
+ 'Alter any availability group',
+ 'Alter any connection',
+ 'Alter any credential',
+ 'Alter any database',
+ 'Alter any endpoint ',
+ 'Alter any event notification ',
+ 'Alter any event session ',
+ 'Alter any linked server',
+ 'Alter any login',
+ 'Alter any server audit',
+ 'Alter any server role',
+ 'Alter resources',
+ 'Alter server state ',
+ 'Alter Settings ',
+ 'Alter trace',
+ 'Authenticate server ',
+ 'Control server',
+ 'Create any database ',
+ 'Create availability group',
+ 'Create DDL event notification',
+ 'Create endpoint',
+ 'Create server role',
+ 'Create trace event notification',
+ 'External access assembly',
+ 'Shutdown',
+ 'Unsafe Assembly',
+ 'View any database',
+ 'View any definition',
+ 'View server state'
+ )
 AND    who.name NOT LIKE '##MS%##'
 AND    who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
-    what.permission_name,
-    who.name
+ what.permission_name,
+ who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'View any definition' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any definition' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41305" severity="medium" conversionstatus="pass" title="SRG-APP-000292-DB-000138" dscresource="None">
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'View any definition' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View any definition' AND    who.name NOT LIKE '##MS%##' AND    who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41305" severity="medium" conversionstatus="pass" title="SRG-APP-000292-DB-000138" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to modify an existing account for later use.
 
 Notification of account creation is one method and best practice for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and/or application owners exist. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.
 
-To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -8120,45 +8124,45 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41306" severity="medium" conversionstatus="pass" title="SRG-APP-000027-DB-000186" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account. 
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41306" severity="medium" conversionstatus="pass" title="SRG-APP-000027-DB-000186" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account.
 
 Auditing of account modification is one method and best practice for mitigating this risk. A comprehensive application account management process ensures an audit trail automatically documents the modification of application user accounts and, as required, notifies administrators, application owners, and/or appropriate individuals. Applications must provide this capability directly, leverage complimentary technology providing this capability, or a combination thereof.
 
-Automated account-auditing processes greatly reduce the risk that accounts will be surreptitiously modified, and provides logging that can be used for forensic purposes.  
+Automated account-auditing processes greatly reduce the risk that accounts will be surreptitiously modified, and provides logging that can be used for forensic purposes.
 
-To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms meeting or exceeding access control policy requirements.  Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms meeting or exceeding access control policy requirements.  Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -8166,44 +8170,44 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-41307" severity="medium" conversionstatus="pass" title="SRG-APP-000019-DB-000197" dscresource="None">
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-41307" severity="medium" conversionstatus="pass" title="SRG-APP-000019-DB-000197" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Remote access is any access to an organizational information system by a user (or an information system) communicating through an external, non-organization-controlled network (e.g., the Internet). Examples of remote access methods include dial-up, broadband, and wireless.
 
 Remote network and system access is accomplished by leveraging common communication protocols to establish a remote connection. These connections will typically originate over either the public Internet or the Public Switched Telephone Network (PSTN). Neither of these internetworking mechanisms is private or secure, and they do not by default restrict access to networked resources once connectivity is established.
 
 Numerous best practices are employed to protect remote connections, such as utilizing encryption to protect data sessions and firewalls to restrict and control network connectivity. In addition to these protections, auditing must also be utilized in order to track system activity, assist in diagnosing system issues, and provide evidence needed for forensic investigations post security incident.
-&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf>V-41021</DuplicateOf>
-      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf>V-41021</DuplicateOf>
+      <GetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT * FROM #StigEvent SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Check to see that all required events are being audited.
 From the query prompt:
      SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
 All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.
 
-Determine the trace(s) being used for the auditing requirement. 
+Determine the trace(s) being used for the auditing requirement.
 In the following, replace # with a trace ID being used for the auditing requirements.
 From the query prompt:
      SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#);
 The following required event IDs should be listed:
-     14, 15, 18, 20, 
-     102, 103, 104, 105, 106, 107, 108, 109, 110, 
-     111, 112, 113, 115, 116, 117, 118, 
-     128, 129, 130, 
-     131, 132, 133, 134, 135, 
-     152, 153, 
+     14, 15, 18, 20,
+     102, 103, 104, 105, 106, 107, 108, 109, 110,
+     111, 112, 113, 115, 116, 117, 118,
+     128, 129, 130,
+     131, 132, 133, 134, 135,
+     152, 153,
      170, 171, 172, 173, 175, 176, 177, 178.
 If any of the audit event IDs required above is not listed, this is a finding.
 
@@ -8211,17 +8215,17 @@ Notes:
 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner.
 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces.  However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account.
 3. It is acceptable to trace additional event IDs. This is the minimum list.
-4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)  
+4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.)
 Use the following query to obtain a list of all event IDs, and their meaning:
-     SELECT * FROM sys.trace_events; 
+     SELECT * FROM sys.trace_events;
 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements.  However, it does represent the aggregate of all such requirements.
-6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
-      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
-      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-    <Rule id="V-55805" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
+6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated.  They will be removed at some point after SQL Server 2014.  The replacement feature is Extended Events.  If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.</RawString>
+      <SetScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount &gt; 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END</SetScript>
+      <TestScript>BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) CREATE TABLE #Trace (TraceId INT) CREATE TABLE #TraceEvent (TraceId INT, EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @traceId INT FETCH NEXT FROM cursorTrace INTO @traceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @traceId, EventId FROM sys.fn_trace_geteventinfo(@traceId) FETCH NEXT FROM cursorTrace INTO @TraceId END CLOSE cursorTrace DEALLOCATE cursorTrace SELECT SE.EventId AS NotFound FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL END</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+    <Rule id="V-55805" severity="medium" conversionstatus="pass" title="SRG-APP-000035-DB-000007" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS.
 
 Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.
@@ -8230,12 +8234,12 @@ Privileges granted outside of SQL Server's role-based account assignments are mo
 
 SQL Server's 'View Any Database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed.
 
-Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View Any Database' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
+Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;true&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <GetScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View Any Database' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</GetScript>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
       <RawString>Obtain the list of accounts that have direct access to the server-level permission 'View Any Database' by running the following query:
 
 SELECT
@@ -8249,7 +8253,7 @@ sys.server_permissions what
 INNER JOIN sys.server_principals who
 ON who.principal_id = what.grantee_principal_id
 WHERE
-what.permission_name = 'View Any Database' 
+what.permission_name = 'View Any Database'
 AND who.name NOT LIKE '##MS%##'
 AND who.type_desc &lt;&gt; 'SERVER_ROLE'
 ORDER BY
@@ -8310,11 +8314,11 @@ ORDER BY
       what.permission_name,
       who.name
 ;
-GO</RawString>
-      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'View Any Database' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
-      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View Any Database' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
-      <Variable />
-      <VariableValue />
-    </Rule>
-  </SqlScriptQueryRule>
-</DISASTIG>
+GO</RawString>
+      <SetScript>DECLARE @name as varchar(512) DECLARE @permission as varchar(512) DECLARE @sqlstring1 as varchar(max) SET @sqlstring1 = 'use master;' SET @permission = 'View Any Database' DECLARE  c1 cursor  for  SELECT who.name AS [Principal Name], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' AND who.name &lt;&gt; 'sa'  AND what.permission_name = @permission OPEN c1 FETCH next FROM c1 INTO @name,@permission WHILE (@@FETCH_STATUS = 0) BEGIN SET @sqlstring1 = @sqlstring1 + 'REVOKE ' + @permission + ' FROM [' + @name + '];' FETCH next FROM c1 INTO @name,@permission END CLOSE c1 DEALLOCATE c1 EXEC ( @sqlstring1 );</SetScript>
+      <TestScript>SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] FROM sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE what.permission_name = 'View Any Database' AND who.name NOT LIKE '##MS%##' AND who.type_desc &lt;&gt; 'SERVER_ROLE' ORDER BY who.name;</TestScript>
+      <Variable />
+      <VariableValue />
+    </Rule>
+  </SqlScriptQueryRule>
+</DISASTIG>
diff --git a/StigData/Processed/SqlServer-2016-Instance-1.8.org.default.xml b/source/StigData/Processed/SqlServer-2016-Instance-1.8.org.default.xml
similarity index 100%
rename from StigData/Processed/SqlServer-2016-Instance-1.8.org.default.xml
rename to source/StigData/Processed/SqlServer-2016-Instance-1.8.org.default.xml
diff --git a/StigData/Processed/SqlServer-2016-Instance-1.8.xml b/source/StigData/Processed/SqlServer-2016-Instance-1.8.xml
similarity index 100%
rename from StigData/Processed/SqlServer-2016-Instance-1.8.xml
rename to source/StigData/Processed/SqlServer-2016-Instance-1.8.xml
diff --git a/source/StigData/Processed/SqlServer-2016-Instance-1.9.org.default.xml b/source/StigData/Processed/SqlServer-2016-Instance-1.9.org.default.xml
new file mode 100644
index 000000000..ea3a9bf53
--- /dev/null
+++ b/source/StigData/Processed/SqlServer-2016-Instance-1.9.org.default.xml
@@ -0,0 +1,8 @@
+<!--
+    The organizational settings file is used to define the local organizations
+    preferred setting within an allowed range of the STIG.
+
+    Each setting in this file is linked by STIG ID and the valid range is in an
+    associated comment.
+-->
+<OrganizationalSettings fullversion="1.9" />
diff --git a/StigData/Processed/SqlServer-2016-Instance-1.7.xml b/source/StigData/Processed/SqlServer-2016-Instance-1.9.xml
similarity index 96%
rename from StigData/Processed/SqlServer-2016-Instance-1.7.xml
rename to source/StigData/Processed/SqlServer-2016-Instance-1.9.xml
index 7fdb9e792..7467d4d77 100644
--- a/StigData/Processed/SqlServer-2016-Instance-1.7.xml
+++ b/source/StigData/Processed/SqlServer-2016-Instance-1.9.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="MS_SQL_Server_2016_Instance_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.xml" releaseinfo="Release: 7 Benchmark Date: 25 Oct 2019" title="MS SQL Server 2016 Instance Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.7" created="2/28/2020">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="MS_SQL_Server_2016_Instance_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil." filename="U_MS_SQL_Server_2016_Instance_STIG_V1R9_Manual-xccdf.xml" releaseinfo="Release: 9 Benchmark Date: 24 Apr 2020" title="MS SQL Server 2016 Instance Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.9" created="5/28/2020">
   <DocumentRule dscresourcemodule="None">
     <Rule id="V-79119" severity="medium" conversionstatus="pass" title="SRG-APP-000001-DB-000031" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks.
@@ -458,7 +458,7 @@ WHERE a.is_state_enabled = 1
 
 If no records are returned, this is a finding.
 
-If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG,” this is not a finding.
+If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG," this is not a finding.
 
 If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding.
 </RawString>
@@ -706,7 +706,7 @@ The common language runtime (CLR) component of the .NET Framework for Microsoft
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#.  CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code.  Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.
+      <RawString>The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.
 
 To determine if CLR is enabled, execute the following commands:
 
@@ -716,14 +716,17 @@ EXEC SP_CONFIGURE 'clr enabled';
 
 If the value of "config_value" is "0", this is not a finding.
 
-Review the system documentation to determine whether the use of CLR code is required and approved. If it is not approved, this is a finding.
+If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding.
 
-If CLR code is required and approved, check for UNSAFE Assembly permission using the following script in Master.  If records are returned and UNSAFE Assembly is not documented and authorized, this is a finding.
+If CLR code is approved, check the database for UNSAFE assembly permission using the following script:
 
+USE [master]
 SELECT *
 FROM sys.assemblies
 WHERE permission_set_desc != 'SAFE'
-AND is_user_defined = 1</RawString>
+AND is_user_defined = 1;
+
+If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.</RawString>
     </Rule>
     <Rule id="V-79181" severity="medium" conversionstatus="pass" title="SRG-APP-000141-DB-000093" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
@@ -901,13 +904,14 @@ Review the Instance configuration:
 
 
 SELECT value_in_use
-FROM   sys.configurations
+FROM sys.configurations
 WHERE name = 'common criteria compliance enabled'
 
-If the value returned for "value_in_use" is not "1", and an exception is not defined in the system documentation, this is a finding.
+If "value_in_use" is set to "1" this is not a finding.
+If "value_in_use" is set to "0" this is a finding.
 
-
-NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If enabling this feature impacts performance, this setting may be disabled and the category reduced to a CAT III finding.</RawString>
+NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding.
+</RawString>
     </Rule>
     <Rule id="V-79213" severity="medium" conversionstatus="pass" title="SRG-APP-000243-DB-000373" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -943,13 +947,13 @@ For each of the directories returned by the above script, verify whether the cor
 4) Navigate to the "Security" tab.
 5) Review the listing of principals and permissions.
 
-Account Type                     Directory Type            Permission
+Account Type            Directory Type        Permission
 -----------------------------------------------------------------------------------------------
-Database Administrators          ALL                       Full Control
+Database Administrators          ALL                           Full Control
 SQL Server Service SID           Data; Log; Backup;        Full Control
 SQL Server Agent Service SID     Backup                    Full Control
-SYSTEM                           ALL                       Full Control
-CREATOR OWNER                    ALL                       Full Control
+SYSTEM                               ALL                           Full Control
+CREATOR OWNER                    ALL                           Full Control
 
 For information on how to determine a "Service SID", go to:
 https://aka.ms/sql-service-sids
@@ -1127,20 +1131,6 @@ FROM sys.server_file_audits
 Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties.
 
 If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-79231" severity="medium" conversionstatus="pass" title="SRG-APP-000360-DB-000320" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.
-
-The appropriate support staff include, at a minimum, the ISSO and the DBA/SA.
-
-Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Review the system documentation to determine which audit failure events require real-time alerts.
-
-Review SQL Server settings and code. If the real-time alerting that is specified in the documentation is not enabled, this is a finding.</RawString>
     </Rule>
     <Rule id="V-79233" severity="medium" conversionstatus="pass" title="SRG-APP-000374-DB-000322" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis.
@@ -2148,25 +2138,27 @@ Prior to SQL Server 2012, NT AUTHORITY\SYSTEM was a member of the sysadmin role
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Execute the following queries. The first query lists permissions granted to NT AUTHORITY\SYSTEM. The second query checks for Clustering and Availability Groups being provisioned in the Database Engine:
+      <RawString>Execute the following queries. The first query checks for Clustering and Availability Groups being provisioned in the Database Engine. The second query lists permissions granted to the Local System account.
+
+SELECT
+    SERVERPROPERTY('IsClustered') AS [IsClustered],
+    SERVERPROPERTY('IsHadrEnabled') AS [IsHadrEnabled]
 
 EXECUTE AS LOGIN = 'NT AUTHORITY\SYSTEM'
 
-SELECT * FROM fn_my_permissions(NULL,NULL)
+SELECT * FROM fn_my_permissions(NULL, 'server')
 
 REVERT
 
 GO
 
-SELECT SERVERPROPERTY('IsClustered') as IsClustered, SERVERPROPERTY('IsHadrEnabled') as IsHadrEnabled
-
-If IsHadrEnabled returns 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "ALTER ANY AVAILABILITY GROUP", and "VIEW ANY DATABASE", this is a finding.
 
-If IsClustered returns 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "VIEW SERVER STATE ", and "VIEW ANY DATABASE", this is a finding.
+If IsClustered returns 1, IsHadrEnabled returns 0, and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding.
 
-If IsHadrEnabled and IsClustered both return 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE ", and "VIEW ANY DATABASE", this is a finding.
+If IsHadrEnabled returns 1 and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding.
 
-If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to SYSTEM beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.</RawString>
+If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-79131" severity="medium" conversionstatus="pass" title="SRG-APP-000080-DB-000063" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
@@ -2391,7 +2383,7 @@ If individuals are not individually authenticated before using the shared accoun
 If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.</RawString>
     </Rule>
     <Rule id="V-79191" severity="medium" conversionstatus="pass" title="SRG-APP-000164-DB-000401" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;OS/enterprise authentication and identification must be used (SQL2-00-023600).  Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved.
+      <Description>&lt;VulnDiscussion&gt;OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001).  Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved.
 
 The DoD standard for authentication is DoD-approved PKI certificates.  Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval.
 
@@ -2570,6 +2562,22 @@ Monitoring of free space can be accomplished using Microsoft System Center or a
       <RawString>The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration.
 
 If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-79231" severity="medium" conversionstatus="pass" title="SRG-APP-000360-DB-000320" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.
+
+The appropriate support staff include, at a minimum, the ISSO and the DBA/SA.
+
+A failure of database auditing will result in either the database continuing to function without auditing or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions
+
+Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason.
+
+If real-time alerts are not sent upon auditing failure, this is a finding.</RawString>
     </Rule>
     <Rule id="V-79249" severity="medium" conversionstatus="pass" title="SRG-APP-000456-DB-000390" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security flaws with software applications, including database management systems, are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.
@@ -3345,7 +3353,7 @@ For more information, see https://support.microsoft.com/en-us/kb/3141890.</RawSt
     <Rule id="V-79141" severity="medium" conversionstatus="pass" title="SRG-APP-000092-DB-000208" dscresource="SqlScriptQuery">
       <Description>&lt;VulnDiscussion&gt;Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <GetScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</GetScript>
+      <GetScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -3364,7 +3372,7 @@ WHERE status_desc = 'STARTED'
 
 All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.</RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</TestScript>
+      <TestScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -3717,7 +3725,7 @@ https://msdn.microsoft.com/en-us/library/cc280663.aspx
     <Rule id="V-79267" severity="medium" conversionstatus="pass" title="SRG-APP-000496-DB-000334" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf>V-79141</DuplicateOf>
-      <GetScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</GetScript>
+      <GetScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -3743,7 +3751,7 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO
 
 If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.</RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</TestScript>
+      <TestScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -3752,7 +3760,7 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is
 
 To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf>V-79141</DuplicateOf>
-      <GetScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</GetScript>
+      <GetScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -3778,7 +3786,7 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO
 
 If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.</RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</TestScript>
+      <TestScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -3851,7 +3859,7 @@ https://msdn.microsoft.com/en-us/library/cc280663.aspx</RawString>
     <Rule id="V-79279" severity="medium" conversionstatus="pass" title="SRG-APP-000501-DB-000336" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf>V-79141</DuplicateOf>
-      <GetScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</GetScript>
+      <GetScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -3877,7 +3885,7 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO
 
 If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.</RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</TestScript>
+      <TestScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -3886,7 +3894,7 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is
 
 To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf>V-79141</DuplicateOf>
-      <GetScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</GetScript>
+      <GetScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -3912,7 +3920,7 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO
 
 If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.</RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</TestScript>
+      <TestScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -3960,7 +3968,7 @@ If "Both failed and successful logins" is not selected, this is a finding.</RawS
     <Rule id="V-79289" severity="medium" conversionstatus="pass" title="SRG-APP-000503-DB-000351" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf>V-79141</DuplicateOf>
-      <GetScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</GetScript>
+      <GetScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -3986,7 +3994,7 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP'
 
 If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding.</RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</TestScript>
+      <TestScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -4098,7 +4106,7 @@ Note that it is particularly important to audit, and tightly control, any action
 
 To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <GetScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</GetScript>
+      <GetScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -4152,12 +4160,45 @@ FROM sys.server_audit_specifications s
 JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
 JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
 WHERE a.is_state_enabled = 1
-AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP',’ LOGOUT_GROUP’,'SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP')
+AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP',
+'AUDIT_CHANGE_GROUP',
+'BACKUP_RESTORE_GROUP',
+'DATABASE_CHANGE_GROUP',
+'DATABASE_OBJECT_CHANGE_GROUP',
+'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP',
+'DATABASE_OPERATION_GROUP',
+'DATABASE_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_PERMISSION_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_IMPERSONATION_GROUP',
+'DATABASE_ROLE_MEMBER_CHANGE_GROUP',
+'DBCC_GROUP',
+'LOGIN_CHANGE_PASSWORD_GROUP',
+'LOGOUT_GROUP',
+'SCHEMA_OBJECT_CHANGE_GROUP',
+'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OBJECT_CHANGE_GROUP',
+'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SERVER_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OPERATION_GROUP',
+'SERVER_PERMISSION_CHANGE_GROUP',
+'SERVER_PRINCIPAL_CHANGE_GROUP',
+'SERVER_PRINCIPAL_IMPERSONATION_GROUP',
+'SERVER_ROLE_MEMBER_CHANGE_GROUP',
+'SERVER_STATE_CHANGE_GROUP',
+'TRACE_CHANGE_GROUP',
+'USER_CHANGE_PASSWORD_GROUP'
+)
+Order by d.audit_action_name
+
 
 If the identified groups are not returned, this is a finding.
+
 </RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</TestScript>
+      <TestScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -4166,7 +4207,7 @@ If the identified groups are not returned, this is a finding.
 
 Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf>V-79293</DuplicateOf>
-      <GetScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</GetScript>
+      <GetScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -4220,12 +4261,45 @@ FROM sys.server_audit_specifications s
 JOIN sys.server_audits a ON s.audit_guid = a.audit_guid
 JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id
 WHERE a.is_state_enabled = 1
-AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP',’ LOGOUT_GROUP’,'SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP')
+AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP',
+'AUDIT_CHANGE_GROUP',
+'BACKUP_RESTORE_GROUP',
+'DATABASE_CHANGE_GROUP',
+'DATABASE_OBJECT_CHANGE_GROUP',
+'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP',
+'DATABASE_OPERATION_GROUP',
+'DATABASE_OWNERSHIP_CHANGE_GROUP',
+'DATABASE_PERMISSION_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_CHANGE_GROUP',
+'DATABASE_PRINCIPAL_IMPERSONATION_GROUP',
+'DATABASE_ROLE_MEMBER_CHANGE_GROUP',
+'DBCC_GROUP',
+'LOGIN_CHANGE_PASSWORD_GROUP',
+'LOGOUT_GROUP',
+'SCHEMA_OBJECT_CHANGE_GROUP',
+'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OBJECT_CHANGE_GROUP',
+'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP',
+'SERVER_OBJECT_PERMISSION_CHANGE_GROUP',
+'SERVER_OPERATION_GROUP',
+'SERVER_PERMISSION_CHANGE_GROUP',
+'SERVER_PRINCIPAL_CHANGE_GROUP',
+'SERVER_PRINCIPAL_IMPERSONATION_GROUP',
+'SERVER_ROLE_MEMBER_CHANGE_GROUP',
+'SERVER_STATE_CHANGE_GROUP',
+'TRACE_CHANGE_GROUP',
+'USER_CHANGE_PASSWORD_GROUP'
+)
+Order by d.audit_action_name
+
 
 If the identified groups are not returned, this is a finding.
+
 </RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</TestScript>
+      <TestScript>USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant &gt; 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
@@ -4236,7 +4310,7 @@ Concurrent connections by the same user from multiple workstations may be valid
 
 (If the fact of multiple, concurrent logons by a given user can be reliably reconstructed from the log entries for other events (logons/connections; voluntary and involuntary disconnections), then it is not mandatory to create additional log entries specifically for this.)&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf>V-79141</DuplicateOf>
-      <GetScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</GetScript>
+      <GetScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</GetScript>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
@@ -4269,7 +4343,7 @@ Right-click on the instance &gt;&gt; Select "Properties" &gt;&gt; Select "Securi
 
 If "Both failed and successful logins" is not selected, this is a finding.</RawString>
       <SetScript>/* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON)</SetScript>
-      <TestScript>SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED'</TestScript>
+      <TestScript>IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist'</TestScript>
       <Variable />
       <VariableValue />
     </Rule>
diff --git a/source/StigData/Processed/Vsphere-6.5-1.4.org.default.xml b/source/StigData/Processed/Vsphere-6.5-1.4.org.default.xml
new file mode 100644
index 000000000..5e15d9f2f
--- /dev/null
+++ b/source/StigData/Processed/Vsphere-6.5-1.4.org.default.xml
@@ -0,0 +1,15 @@
+<!--
+    The organizational settings file is used to define the local organizations
+    preferred setting within an allowed range of the STIG.
+
+    Each setting in this file is linked by STIG ID and the valid range is in an
+    associated comment.
+-->
+<OrganizationalSettings fullversion="1.4">
+  <!-- Ensure 'V-93955' is set to "Syslog.global.logHost" = "site specific log host"-->
+  <OrganizationalSetting id="V-93955" AdvancedSettings="" />
+  <!-- Ensure "'V-94037'" is set to "Syslog.global.logDir" = "site specific log storage location"-->
+  <OrganizationalSetting id="V-94037" AdvancedSettings="" />
+  <!-- Ensure 'V-94039.b' is set to a string array of authoritative DoD time sources-->
+  <OrganizationalSetting id="V-94039.b" NtpServer="" />
+</OrganizationalSettings>
diff --git a/source/StigData/Processed/Vsphere-6.5-1.4.xml b/source/StigData/Processed/Vsphere-6.5-1.4.xml
new file mode 100644
index 000000000..ca85032c3
--- /dev/null
+++ b/source/StigData/Processed/Vsphere-6.5-1.4.xml
@@ -0,0 +1,1292 @@
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="VMware_vSphere_6-5_ESXi_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_VMW_vSphere_6-5_ESXi_STIG_V1R4_Manual-xccdf.xml" releaseinfo="Release: 4 Benchmark Date: 24 Apr 2020" title="VMware vSphere 6.5 ESXi Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.4" created="5/28/2020">
+  <DocumentRule dscresourcemodule="None">
+    <Rule id="V-94025" severity="low" conversionstatus="pass" title="SRG-OS-000104-VMM-000500" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configuration &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.hostsvc.esxAdminsGroup value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" keyword is set to "ESX Admins", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94079" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;In order to communicate with virtual switches in VST mode, external switch ports must be configured as trunk ports. VST mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. The auto or desirable physical switch settings do not work with the ESXi Server because the physical switch communicates with the ESXi Server using DTP. The non-negotiate and on options unconditionally enable VLAN trunking on the physical switch and create a VLAN trunk link between the ESXi Server and the physical switch. The difference between non-negotiate and on options is that on mode still sends out DTP frames, whereas the non-negotiate option does not.  The non-negotiate option should be used for all VLAN trunks, to minimize unnecessary network traffic for virtual switches in VST mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of external switch ports as trunk ports must be documented. Virtual Switch Tagging (VST) mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. Inspect the documentation and verify that the documentation is correct and updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream external switch ports.
+
+If DTP is enabled on the physical switch ports connected to the ESXi Host, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94081" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Since VMware virtual switches do not support STP, the ESXi host-connected physical switch ports must have portfast configured if spanning tree is enabled to avoid loops within the physical switch network. If these are not set, potential performance and connectivity issues might arise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's spanning tree protocol is not disabled or portfast is not configured for all physical ports connected to ESXi hosts, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94083" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When defining a physical switch port for trunk mode, only specified VLANs must be configured on the VLAN trunk link. The risk with not fully documenting all VLANs on the vSwitch is that it is possible that a physical trunk port might be configured without needed VLANs, or with unneeded VLANs, potentially enabling an administrator to either accidentally or maliciously connect a VM to an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that unneeded VLANs are configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that only needed VLANs are configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's configuration is trunked VLANs that are not used by ESXi for all physical ports connected to ESXi hosts, this is a finding.</RawString>
+    </Rule>
+  </DocumentRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-93949" severity="medium" conversionstatus="pass" title="SRG-OS-000027-VMM-000080" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Enabling lockdown mode disables direct access to an ESXi host requiring the host be managed remotely from vCenter Server. This is done to ensure the roles and access controls implemented in vCenter are always enforced and users cannot bypass them by logging into a host directly. By forcing all interaction to occur through vCenter Server, the risk of someone inadvertently attaining elevated privileges or performing tasks that are not properly audited is greatly reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Scroll down to "Lockdown Mode" and verify it is set to Enabled (Normal or Strict).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}
+
+If Lockdown Mode is disabled, this is a finding.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-93953" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;In vSphere you can add users to the Exception Users list from the vSphere Web Client. These users do not lose their permissions when the host enters lockdown mode. Usually you may want to add service accounts such as a backup agent to the Exception Users list. Verify that the list of users who are exempted from losing permissions is legitimate and as needed per your environment. Users who do not require special permissions should not be exempted from lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under lockdown mode review the exception users list.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following script:
+
+$vmhost = Get-VMHost | Get-View
+$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
+$lockdown.QueryLockdownExceptions()
+
+If the Exception users list contains accounts that do not require special permissions, this is a finding.
+
+Note - This list is not intended for system administrator accounts but for special circumstances such as a service account.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-93965" severity="medium" conversionstatus="pass" title="SRG-OS-000023-VMM-000060" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Banner" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Banner /etc/issue", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93967" severity="medium" conversionstatus="pass" title="SRG-OS-000033-VMM-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Approved algorithms should impart some level of confidence in their implementation. Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
+
+Note: This does not imply FIPS 140-2 validation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command from an SSH session connected to the ESXi host, or from the ESXi shell:
+
+# grep -i "^Ciphers" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Ciphers aes128-ctr,aes192-ctr,aes256-ctr", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93969" severity="high" conversionstatus="pass" title="SRG-OS-000033-VMM-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used. Only SSH protocol version 2 connections should be permitted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Protocol" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Protocol 2", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93971" severity="medium" conversionstatus="pass" title="SRG-OS-000107-VMM-000530" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via ".rhosts" files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^IgnoreRhosts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "IgnoreRhosts yes", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93973" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptographic host-based authentication is more secure than ".rhosts" authentication, since hosts are cryptographically authenticated. However, it is not recommended that hosts unilaterally trust one another, even within an organization.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^HostbasedAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "HostbasedAuthentication no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93975" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitRootLogin" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitRootLogin no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93977" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitEmptyPasswords" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitEmptyPasswords no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93979" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitUserEnvironment" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitUserEnvironment no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93981" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MACs" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93983" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GSSAPIAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GSSAPIAuthentication no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93985" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Kerberos authentication for SSH is often implemented using GSSAPI.  If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation.  Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation.  To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^KerberosAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "KerberosAuthentication no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93987" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^StrictModes" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "StrictModes yes", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93989" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Compression" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Compression no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93991" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs. Gateway ports allow remote forwarded ports to bind to non-loopback addresses on the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GatewayPorts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GatewayPorts no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93993" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;X11 forwarding over SSH allows for the secure remote execution of X11-based applications. This feature can increase the attack surface of an SSH connection.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^X11Forwarding" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "X11Forwarding no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93995" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Environment variables can be used to change the behavior of remote sessions and should be limited. Locale environment variables that specify the language, character set, and other features modifying the operation of software to match the user's preferences.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^AcceptEnv" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "AcceptEnv", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93997" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;OpenSSH has the ability to create network tunnels (layer-2 and layer-3) over an SSH connection. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitTunnel" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitTunnel no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93999" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;This ensures a user login will be terminated as soon as the "ClientAliveCountMax" is reached.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveCountMax" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveCountMax 3", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94001" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveInterval" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveInterval 200", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94003" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The SSH protocol has the ability to provide multiple sessions over a single connection without reauthentication. A compromised client could use this feature to establish additional sessions to a system without consent or knowledge of the user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MaxSessions" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MaxSessions 1", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94005" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;ESXi hosts come with SSH which can be enabled to allow remote access without requiring user authentication.  To enable password free access copy the remote users public key into the "/etc/ssh/keys-root/authorized_keys" file on the ESXi host.  The presence of the remote user's public key in the "authorized_keys" file identifies the user as trusted, meaning the user is granted access to the host without providing a password.  If using Lockdown Mode and SSH is disabled then login with authorized keys will have the same restrictions as username/password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# ls -la /etc/ssh/keys-root/authorized_keys
+
+or
+
+# cat /etc/ssh/keys-root/authorized_keys
+
+If the authorized_keys file exists and is not empty, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94011" severity="medium" conversionstatus="pass" title="SRG-OS-000077-VMM-000440" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If the remember setting is not set or is not "remember=5", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94013" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If sha512 is not listed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94021" severity="low" conversionstatus="pass" title="SRG-OS-000104-VMM-000500" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services.  Verify the Directory Services Type is set to Active Directory.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the Directory Services Type is not set to "Active Directory", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94023" severity="medium" conversionstatus="pass" title="SRG-OS-000104-VMM-000500" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Security and Services &gt;&gt; Security Settings &gt;&gt; Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; Join Domain Method. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if JoinADEnabled is True then JoinDomainMethod should be "FixedCAMConfigOption".
+
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-94027" severity="low" conversionstatus="pass" title="SRG-OS-000107-VMM-000530" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services and view the Smart Card Authentication status. If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94043" severity="medium" conversionstatus="pass" title="SRG-OS-000423-VMM-001700" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;While encrypted vMotion is available now vMotion traffic should still be sequestered from other traffic to further protect it from attack. This network must be only be accessible to other ESXi hosts preventing outside access to the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The vMotion VMKernel port group should in a dedicated VLAN that can be on a common standard or distributed virtual switch as long as the vMotion VLAN is not shared by any other function and it not routed to anything but ESXi hosts.  The check for this will be unique per environment.  From the vSphere Client select the ESXi host and go to Configuration &gt; Networking and review the VLAN associated with the vMotion VMkernel(s) and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If long distance or cross vCenter vMotion is used the vMotion network can be routable but must be accessible to only the intended ESXi hosts.
+
+If the vMotion port group is not on an isolated VLAN and/or is routable to systems other than ESXi hosts, this is a finding.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-94047" severity="medium" conversionstatus="pass" title="SRG-OS-000423-VMM-001700" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI and NFS. This configuration might expose IP-based storage traffic to unauthorized virtual machine users. IP-based storage frequently is not encrypted. It can be viewed by anyone with access to this network. To restrict unauthorized users from viewing the IP-based storage traffic, the IP-based storage network must be logically separated from the production traffic. Configuring the IP-based storage adaptors on separate VLANs or network segments from other VMkernels and Virtual Machines will limit unauthorized users from viewing the traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>IP-Based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a common standard or distributed virtual switch that is logically separated from other traffic types.  The check for this will be unique per environment.
+
+From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; VMkernel adapters and review the VLANs associated with any IP-Based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If any IP-Based storage networks are not isolated from other traffic types, this is a finding.
+
+If IP-based storage is not used, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-94051" severity="low" conversionstatus="pass" title="SRG-OS-000423-VMM-001700" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;There are three different TCP/IP stacks by default available on ESXi now which are Default, Provisioning, and vMotion.  To better protect and isolate sensitive network traffic within ESXi admins must configure each of these stacks.  Additional custom TCP/IP stacks can be created if desired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; TCP/IP configuration. Review the default system TCP/IP stacks and verify they are configured with the appropriate IP address information.
+
+If vMotion and Provisioning VMKernels are in use and are not utilizing their own TCP/IP stack, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94055" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When enabled, vSphere performs bidirectional authentication of both the iSCSI target and host. There is a potential for a MiTM attack, when not authenticating both the iSCSI target and host, in which an attacker might impersonate either side of the connection to steal data. Bidirectional authentication mitigates this risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Storage &gt;&gt; Storage Adapters &gt;&gt; Select the iSCSI adapter &gt;&gt; Properties &gt;&gt; Authentication method and view the CHAP configuration and verify CHAP is "Required" for target and host authentication.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostHba | Where {$_.Type -eq "iscsi"} | Select AuthenticationProperties -ExpandProperty AuthenticationProperties
+
+If iSCSI is not used, this is not a finding.
+
+If iSCSI is used and CHAP is not set to "Required" for both the target and host, this is a finding.
+
+If iSCSI is used and unique CHAP secrets are not used for each host, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94059" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access. Reduce the risk by configuring the ESXi firewall to only allow access from authorized networks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under the Firewall section click Edit and for each enabled service click Firewall and review the allowed IPs. Check this for Incoming and Outgoing connections.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostFirewallException | Where {$_.Enabled -eq $true} | Select Name,Enabled,@{N="AllIPEnabled";E={$_.ExtensionData.AllowedHosts.AllIP}}
+
+If for an enabled service "Allow connections from any IP address" is selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94061" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;In addition to service specific firewall rules ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic.  Reduce the risk of attack by making sure this is set to deny incoming and outgoing traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostFirewallDefaultPolicy
+
+If the Incoming or Outgoing policies are True, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94349" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server.  Place this user in the Exception Users list.  When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server. Place this user in the Exception Users list. When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.
+
+From the Host Client, select the ESXi host, right click and go to "Permissions". Verify the CIM account user role is limited to read only and CIM permissions.
+
+If there is no dedicated CIM account and the root is used for CIM monitoring, this is a finding.
+
+If write access is not required and the access level is not "read-only", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94477" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Always check the SHA1 or MD5 hash after downloading an ISO, offline bundle, or patch to ensure integrity and authenticity of the downloaded files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The downloaded ISO, offline bundle, or patch hash must be verified against the vendor's checksum to ensure the integrity and authenticity of the files.
+
+See some typical command line example(s) for both the md5 and sha1 hash check(s) directly below.
+
+# md5sum &lt;filename&gt;.iso
+# sha1sum &lt;filename&gt;.iso
+
+If any of the system's downloaded ISO, offline bundle, or system patch hashes cannot be verified against the vendor's checksum, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94479" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If vCenter Update Manager is used on the network it can be used to scan all hosts for missing patches.  From the vSphere Client go to Hosts and Clusters &gt; Update Manager tab and select scan to view all hosts compliance status.
+
+If vCenter Update Manager is not used a hosts compliance status must be manually determined by the build number.  The following VMware KB 1014508 can be used to correlate patches with build numbers.
+
+If the ESXi host does not have the latest patches, this is a finding.
+
+If the ESXi host is not on a supported release, this is a finding.
+
+VMware also publishes Advisories on security patches, and offers a way to subscribe to email alerts for them.
+https://www.vmware.com/support/policies/security_response</RawString>
+    </Rule>
+    <Rule id="V-94487" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Secure Boot is a protocol of UEFI firmware that ensures the integrity of the boot process from hardware up through to the OS. Secure Boot for ESXi requires support from the firmware and it requires that all ESXi kernel modules, drivers, and VIBs be signed by VMware or a partner subordinate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -s
+
+If the output is not Enabled, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94489" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The default self-signed, VMCA issued host certificate must be replaced with a DoD-approved certificate. The use of a DoD certificate on the host assures clients that the service they are connecting to is legitimate and properly secured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+# openssl x509 -in /etc/vmware/ssl/rui.crt -text | grep Issuer
+
+If the issuer is not a DoD approved certificate authority, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94505" severity="low" conversionstatus="pass" title="SRG-OS-000109-VMM-000550" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser"", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-100543" severity="medium" conversionstatus="pass" title="SRG-OS-000423-VMM-001700" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The vSphere management network provides access to the vSphere management interface on each component. Services running on the management interface provide an opportunity for an attacker to gain privileged access to the systems. Any remote attack most likely would begin with gaining entry to this network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The Management VMkernel port group should in a dedicated VLAN that can be on a common standard or distributed virtual switch as long as the Management VLAN is not shared by any other function and it not accessible to anything other than management related functions such as vCenter.  The check for this will be unique per environment.
+
+From the vSphere Web Client select the ESXi host and go to Configure &gt;&gt; Networking and review the VLAN associated with the Management VMkernel and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If the network segment is accessible, except to networks where other management-related entities are located such as vCenter, this is a finding.</RawString>
+    </Rule>
+  </ManualRule>
+  <VsphereAcceptanceLevelRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94041" severity="high" conversionstatus="pass" title="SRG-OS-000366-VMM-001430" dscresource="VMHostAcceptanceLevel">
+      <Description>&lt;VulnDiscussion&gt;Verify the ESXi Image Profile to only allow signed VIBs.  An unsigned VIB represents untested code installed on an ESXi host.  The ESXi Image profile supports four acceptance levels:
+
+(1) VMwareCertified - VIBs created, tested and signed by VMware
+(2) VMwareAccepted - VIBs created by a VMware partner but tested and signed by VMware,
+(3) PartnerSupported - VIBs created, tested and signed by a certified VMware partner
+(4) CommunitySupported - VIBs that have not been tested by VMware or a VMware partner.
+
+Community Supported VIBs are not supported and do not have a digital signature.  To protect the security and integrity of your ESXi hosts do not allow unsigned (CommunitySupported) VIBs to be installed on your hosts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Level>PartnerSupported</Level>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under "Host Image Profile Acceptance Level" view the acceptance level.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.software.acceptance.get()
+
+If the acceptance level is CommunitySupported, this is a finding.</RawString>
+    </Rule>
+  </VsphereAcceptanceLevelRule>
+  <VsphereAdvancedSettingsRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-93951" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'DCUI.Access' = 'root'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Lockdown mode disables direct host access requiring that admins manage hosts from vCenter Server.  However, if a host becomes isolated from vCenter Server, the admin is locked out and can no longer manage the host. If you are using normal lockdown mode, you can avoid becoming locked out of an ESXi host that is running in lockdown mode, by setting DCUI.Access to a list of highly trusted users who can override lockdown mode and access the DCUI. The DCUI is not running in strict lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the DCUI.Access value and verify only the root user is listed.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.
+
+If the DCUI.Access is not restricted to root, this is a finding.
+
+Note: This list is only for local user accounts and should only contain the root user.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-93955" severity="medium" conversionstatus="pass" title="SRG-OS-000032-VMM-000130" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>
+      </AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Remote logging to a central log host provides a secure, centralized store for ESXi logs. By gathering host log files onto a central host it can more easily monitor all hosts with a single tool. It can also do aggregate analysis and searching to look for such things as coordinated attacks on multiple hosts. Logging to a secure, centralized log server also helps prevent log tampering and also provides a long-term audit record.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} is set to "Syslog.global.logHost" = "site specific log host"</OrganizationValueTestString>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Syslog.global.logHost value and verify it is set to a site specific syslog server hostname.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost
+
+If the Syslog.global.logHost setting is not set to a site specific syslog server, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93957" severity="medium" conversionstatus="pass" title="SRG-OS-000021-VMM-000050" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Security.AccountLockFailures' = '3'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountLockFailures value and verify it is set to 3.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures and verify it is set to 3.
+
+If the Security.AccountLockFailures is set to a value other than 3, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93959" severity="medium" conversionstatus="pass" title="SRG-OS-000329-VMM-001180" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Security.AccountUnlockTime' = '900'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountUnlockTime value and verify it is set to 900.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime and verify it is set to 900.
+
+If the Security.AccountUnlockTime is set to a value other than 900, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93961" severity="medium" conversionstatus="pass" title="SRG-OS-000023-VMM-000060" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Annotations.WelcomeMessage' = 'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+-At any time, the USG may inspect and seize data stored on this IS.
+
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests- -not for your personal benefit or privacy.
+
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Annotations.WelcomeMessage value and verify it contains the DoD logon banner to follow.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage
+
+Check for either of the following login banners based on the character limitations imposed by the system. An exact match of the text is required. If one of these banners is not displayed, this is a finding.
+
+You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+-At any time, the USG may inspect and seize data stored on this IS.
+
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests- -not for your personal benefit or privacy.
+
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
+
+OR
+
+I've read &amp; consent to terms in IS user agreem't.
+
+If the DCUI logon screen does not display the DoD logon banner, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93963" severity="medium" conversionstatus="pass" title="SRG-OS-000023-VMM-000060" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Config.Etc.issue' = 'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.Etc.issue value and verify it is set to DoD logon banner below.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue
+
+If the Config.Etc.issue setting (/etc/issue file) does not contain the logon banner exactly as shown below this is a finding.
+
+"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."</RawString>
+    </Rule>
+    <Rule id="V-94007" severity="low" conversionstatus="pass" title="SRG-OS-000037-VMM-000150" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Config.HostAgent.log.level' = 'info'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.HostAgent.log.level value and verify it is set to "info".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level
+
+If the Config.HostAgent.log.level setting is not set to info, this is a finding.
+
+Note: Verbose logging level is acceptable for troubleshooting purposes.</RawString>
+    </Rule>
+    <Rule id="V-94009" severity="medium" conversionstatus="pass" title="SRG-OS-000069-VMM-000360" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Security.PasswordQualityControl' = 'similar=deny retry=3 min=disabled,disabled,disabled,disabled,15'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Security.PasswordQualityControl value and verify it is set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15"
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.PasswordQualityControl
+
+If the Security.PasswordQualityControl setting is not set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94015" severity="medium" conversionstatus="pass" title="SRG-OS-000095-VMM-000480" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Config.HostAgent.plugins.solo.enableMob' = 'false'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;The Managed Object Browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host and enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK, but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access.  By default this is disabled for ESXi in version 6.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Config.HostAgent.plugins.solo.enableMob value and verify it is set to false.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob
+
+If the Config.HostAgent.plugins.solo.enableMob setting is not set to false, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94029" severity="medium" conversionstatus="pass" title="SRG-OS-000163-VMM-000700" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'UserVars.ESXiShellInteractiveTimeOut' = '600'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;If a user forgets to log out of their SSH session, the idle connection will remains open indefinitely, increasing the potential for someone to gain privileged access to the host.  The ESXiShellInteractiveTimeOut allows you to automatically terminate idle shell sessions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellInteractiveTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut
+
+If the UserVars.ESXiShellInteractiveTimeOut setting is not set to 600, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94031" severity="medium" conversionstatus="pass" title="SRG-OS-000163-VMM-000700" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'UserVars.ESXiShellTimeOut' = '600'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;When the ESXi Shell or SSH services are enabled on a host they will run indefinitely.  To avoid having these services left running set the ESXiShellTimeOut.  The ESXiShellTimeOut defines a window of time after which the ESXi Shell and SSH services will automatically be terminated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut
+
+If the UserVars.ESXiShellTimeOut setting is not set to 600, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94033" severity="medium" conversionstatus="pass" title="SRG-OS-000163-VMM-000700" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'UserVars.DcuiTimeOut' = '600'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;When the Direct console user interface (DCUI) is enabled and logged in it should be automatically logged out if left logged in to avoid unauthorized privilege gains.  The DcuiTimeOut defines a window of time after which the DCUI will be logged out.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.DcuiTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut
+
+If the UserVars.DcuiTimeOut setting is not set to 600, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94037" severity="medium" conversionstatus="pass" title="SRG-OS-000341-VMM-001220" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>
+      </AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;ESXi can be configured to store log files on an in-memory file system.  This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done only a single day's worth of logs are stored at any time. In addition log files will be reinitialized upon each reboot.  This presents a security risk as user activity logged on the host is only stored temporarily and will not persistent across reboots.  This can also complicate auditing and make it harder to monitor events and diagnose issues.  ESXi host logging should always be configured to a persistent datastore.
+
+Note: Scratch space is configured automatically during installation or first boot of an ESXi host, and does not usually need to be manually configured. ESXi Installable creates a 4 GB Fat16 partition on the target device during installation if there is sufficient space, and if the device is considered Local.  If ESXi is installed on an SD card or USB device a persistent log location may not be configured upon install as normal.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>"{0}" is set to "Syslog.global.logDir" = "site specific log storage location"</OrganizationValueTestString>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Syslog.global.logDir value and verify it is set to a persistent location.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir
+
+or
+
+$esxcli = Get-EsxCli
+$esxcli.system.syslog.config.get() | Select LocalLogOutput,LocalLogOutputIsPersistent
+
+If the Syslog.global.logDir or LocalLogOutput value is not on persistent storage, this is a finding.
+
+If the LocalLogOutputIsPersistent value is not true, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94057" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Mem.ShareForceSalting' = '2'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try and determine an AES encryption key in use on another virtual machine running on the same physical processor of the host server if Transparent Page Sharing is enabled between the two virtual machines. This technique works only in a highly controlled system configured in a non-standard way that VMware believes would not be recreated in a production environment.
+
+Even though VMware believes information being disclosed in real world conditions is unrealistic, out of an abundance of caution upcoming ESXi Update releases will no longer enable TPS between Virtual Machines by default (TPS will still be utilized within individual VMs).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Mem.ShareForceSalting value and verify it is set to 2.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting
+
+If the Mem.ShareForceSalting setting is not set to 2, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94063" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Net.BlockGuestBPDU' = '1'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected to reduce the STP convergence delay. If a BPDU packet is sent from a virtual machine on the ESXi host to the physical switch so configured, a cascading lockout of all the uplink interfaces from the ESXi host can occur. To prevent this type of lockout, BPDU Filter can be enabled on the ESXi host to drop any BPDU packets being sent to the physical switch. The caveat is that certain SSL VPN which use Windows bridging capability can legitimately generate BPDU packets. The administrator should verify that there are no legitimate BPDU packets generated by virtual machines on the ESXi host prior to enabling BPDU Filter.  If BPDU Filter is enabled in this situation, enabling Reject Forged Transmits on the virtual switch port group adds protection against Spanning Tree loops.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.BlockGuestBPDU value and verify it is set to 1.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU
+
+If the Net.BlockGuestBPDU setting is not set to 1, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94071" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Net.DVFilterBindIpAddress' = ''</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;If you are not using products that make use of the dvfilter network API, the host should not be configured to send network information to a VM. If the API is enabled an attacker might attempt to connect a VM to it thereby potentially providing access to the network of other VMs on the host. If you are using a product that makes use of this API then verify that the host has been configured correctly. If you are not using such a product make sure the setting is blank.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.DVFilterBindIpAddress value and verify the value is blank or the correct IP address of a security appliance if in use.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.DVFilterBindIpAddress
+
+If the Net.DVFilterBindIpAddress is not blank and security appliances are not in use on the host, this is a finding.</RawString>
+    </Rule>
+  </VsphereAdvancedSettingsRule>
+  <VsphereKernelActiveDumpPartitionRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94035" severity="low" conversionstatus="pass" title="SRG-OS-000269-VMM-000950" dscresource="VMHostKernelActiveDumpPartition">
+      <Description>&lt;VulnDiscussion&gt;In the event of a system failure, the system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Enabled>$true</Enabled>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and right click.  If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.system.coredump.partition.get()
+$esxcli.system.coredump.network.get()
+
+The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables.
+
+If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.</RawString>
+    </Rule>
+  </VsphereKernelActiveDumpPartitionRule>
+  <VsphereNtpSettingsRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94039.b" severity="medium" conversionstatus="pass" title="SRG-OS-000355-VMM-001330" dscresource="VMHostNtpSettings">
+      <Description>&lt;VulnDiscussion&gt;To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <NtpServer />
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} is set to a string array of authoritative DoD time sources</OrganizationValueTestString>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to verify the configured NTP servers and service startup policy.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostNTPServer
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"}
+
+If the NTP service is not configured with authoritative DoD time sources and the service is not configured to start and stop with the host and is running, this is a finding.</RawString>
+    </Rule>
+  </VsphereNtpSettingsRule>
+  <VspherePortGroupSecurityRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94065.a" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated source MAC address at any time. This allows an operating system to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network.
+
+This means the virtual switch does not compare the source and effective MAC addresses.
+
+To protect against MAC address impersonation, all virtual switches should have forged transmissions set to Reject. Reject Forged Transmit can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited>$true</ForgedTransmitsInherited>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Forged Transmits" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94067.a" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. Reject MAC Changes can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited>$true</MacChangesInherited>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "MAC Address Changes" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94069.a" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited>$true</AllowPromiscuousInherited>
+      <Description>&lt;VulnDiscussion&gt;When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that Portgroup. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting. Promiscous mode can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Promiscuous Mode" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94073" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;ESXi does not use the concept of native VLAN. Frames with VLAN specified in the port group will have a tag, but frames with VLAN not specified in the port group are not tagged and therefore will end up as belonging to native VLAN of the physical switch. For example, frames on VLAN 1 from a Cisco physical switch will be untagged, because this is considered as the native VLAN. However, frames from ESXi specified as VLAN 1 will be tagged with a "1"; therefore, traffic from ESXi that is destined for the native VLAN will not be correctly routed (because it is tagged with a "1" instead of being untagged), and traffic from the physical switch coming from the native VLAN will not be visible (because it is not tagged). If the ESXi virtual switch port group uses the native VLAN ID, traffic from those VMs will not be visible to the native VLAN on the switch, because the switch is expecting untagged traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to the native VLAN ID of the attached physical switch.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with the native VLAN of the ESXi hosts attached physical switch, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94075" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes all network frames to the guest VM without modifying the VLAN tags, leaving it up to the guest to deal with them. VLAN 4095 should be used only if the guest has been specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it might cause denial-of-service or allow a guest VM to interact with traffic on an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to 4095.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanID
+
+If any port group is configured with VLAN 4095 and is not documented as a needed exception, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94077" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;Certain physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001–1024 and 4094, while Nexus switches typically reserve 3968–4047 and 4094. Check with the documentation for your specific switch. Using a reserved VLAN might result in a denial of service on the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to a reserved VLAN ID.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with a reserved VLAN ID, this is a finding.</RawString>
+    </Rule>
+  </VspherePortGroupSecurityRule>
+  <VsphereServiceRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94017" severity="medium" conversionstatus="pass" title="SRG-OS-000095-VMM-000480" dscresource="VMHostService">
+      <Description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides temporary access to commands essential for server maintenance. Intended primarily for use in break-fix scenarios, the ESXi shell is well suited for checking and modifying configuration details, not always generally accessible, using the vSphere Client. The ESXi shell is accessible remotely using SSH by users with the Administrator role. Under normal operating conditions, SSH access to the host must be disabled as is the default.  As with the ESXi shell, SSH is also intended only for temporary use during break-fix scenarios. SSH must therefore be disabled under normal operating conditions and must only be enabled for diagnostics or troubleshooting. Remote access to the host must therefore be limited to the vSphere Client at all other times.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>TSM-SSH</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Policy>off</Policy>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit and view the "SSH" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"}
+
+If the ESXi SSH service is running, this is a finding.</RawString>
+      <Running>False</Running>
+    </Rule>
+    <Rule id="V-94019" severity="medium" conversionstatus="pass" title="SRG-OS-000095-VMM-000480" dscresource="VMHostService">
+      <Description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>TSM</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Policy>off</Policy>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under Services select Edit and view the "ESXi Shell" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"}
+
+If the ESXi Shell service is running, this is a finding.</RawString>
+      <Running>False</Running>
+    </Rule>
+    <Rule id="V-94039.a" severity="medium" conversionstatus="pass" title="SRG-OS-000355-VMM-001330" dscresource="VMHostService">
+      <Description>&lt;VulnDiscussion&gt;To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>ntpd</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Policy>Automatic</Policy>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to verify the configured NTP servers and service startup policy.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostNTPServer
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"}
+
+If the NTP service is not configured with authoritative DoD time sources and the service is not configured to start and stop with the host and is running, this is a finding.</RawString>
+      <Running>True</Running>
+    </Rule>
+  </VsphereServiceRule>
+  <VsphereSnmpAgentRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94053" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostSnmpAgent">
+      <Description>&lt;VulnDiscussion&gt;If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Enabled>$false</Enabled>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostSnmp | Select *
+
+or
+
+From a console or ssh session run the follow command:
+
+esxcli system snmp get
+
+If SNMP is not in use and is enabled, this is a finding.
+
+If SNMP is enabled and read only communities is set to public, this is a finding.
+
+If SNMP is enabled and is not using v3 targets, this is a finding.
+
+Note: SNMP v3 targets can only be viewed and configured from the esxcli command.</RawString>
+    </Rule>
+  </VsphereSnmpAgentRule>
+  <VsphereVssSecurityRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94065.b" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssSecurity">
+      <AllowPromiscuous />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated source MAC address at any time. This allows an operating system to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network.
+
+This means the virtual switch does not compare the source and effective MAC addresses.
+
+To protect against MAC address impersonation, all virtual switches should have forged transmissions set to Reject. Reject Forged Transmit can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmits>$false</ForgedTransmits>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChanges />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Forged Transmits" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94067.b" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssSecurity">
+      <AllowPromiscuous />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. Reject MAC Changes can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmits />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChanges>$false</MacChanges>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "MAC Address Changes" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94069.b" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssSecurity">
+      <AllowPromiscuous>$false</AllowPromiscuous>
+      <Description>&lt;VulnDiscussion&gt;When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that Portgroup. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting. Promiscous mode can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmits />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChanges />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Promiscuous Mode" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+  </VsphereVssSecurityRule>
+</DISASTIG>
diff --git a/StigData/Processed/WindowsClient-10-1.19.org.default.xml b/source/StigData/Processed/WindowsClient-10-1.19.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsClient-10-1.19.org.default.xml
rename to source/StigData/Processed/WindowsClient-10-1.19.org.default.xml
diff --git a/StigData/Processed/WindowsClient-10-1.19.xml b/source/StigData/Processed/WindowsClient-10-1.19.xml
similarity index 97%
rename from StigData/Processed/WindowsClient-10-1.19.xml
rename to source/StigData/Processed/WindowsClient-10-1.19.xml
index e33a96cc8..ac2830950 100644
--- a/StigData/Processed/WindowsClient-10-1.19.xml
+++ b/source/StigData/Processed/WindowsClient-10-1.19.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Windows_10_STIG" description="The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_10_STIG_V1R19_Manual-xccdf.xml" releaseinfo="Release: 19 Benchmark Date: 25 Oct 2019" title="Windows 10 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.19" created="11/18/2019">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Windows_10_STIG" description="The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_10_STIG_V1R19_Manual-xccdf.xml" releaseinfo="Release: 19 Benchmark Date: 25 Oct 2019" title="Windows 10 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.19" created="6/17/2020">
   <AccountPolicyRule dscresourcemodule="SecurityPolicyDsc">
     <Rule id="V-63405" severity="medium" conversionstatus="pass" title="WN10-AC-000005" dscresource="AccountPolicy">
       <Description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.   This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1129,2189 +1129,2052 @@ Verify the Bluetooth radio is turned off unless approved by the organization. If
 
 Approval must be documented with the ISSO.</RawString>
     </Rule>
-  </DocumentRule>
-  <ManualRule dscresourcemodule="None">
-    <Rule id="V-63319" severity="medium" conversionstatus="pass" title="WN10-00-000005" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77189" severity="medium" conversionstatus="pass" title="WN10-EP-000070" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-For standalone systems, this is NA.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Open "Settings".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Select "System", then "About".
+Enter "Get-ProcessMitigation -Name Acrobat.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If "Edition" is not "Windows 10 Enterprise", this is a finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-If "System type" is not "64-bit operating system…", this is a finding.</RawString>
+DEP:
+Enable: ON
+
+ASLR:
+BottomUp: ON
+ForceRelocateImages: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63323" severity="low" conversionstatus="pass" title="WN10-00-000010" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77191" severity="medium" conversionstatus="pass" title="WN10-EP-000080" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify domain-joined systems have a TPM enabled and ready for use.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-For standalone systems, this is NA.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+Enter "Get-ProcessMitigation -Name AcroRd32.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Verify the system has a TPM and is ready for use.
-Run "tpm.msc".
-Review the sections in the center pane.
-"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken".
-TPM Manufacturer Information - Specific Version = 2.0 or 1.2
+If the following mitigations do not have a status of "ON", this is a finding:
 
-If a TPM is not found or is not ready for use, this is a finding.
+DEP:
+Enable: ON
 
-NOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.</RawString>
+ASLR:
+BottomUp: ON
+ForceRelocateImages: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63337" severity="medium" conversionstatus="pass" title="WN10-00-000030" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77195" severity="medium" conversionstatus="pass" title="WN10-EP-000090" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify all Windows 10 information systems (including SIPRNET) employ BitLocker for full disk encryption.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If full disk encryption using BitLocker is not implemented, this is a finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Verify BitLocker is turned on for the operating system drive and any fixed data drives.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Open "BitLocker Drive Encryption" from the Control Panel.
+Enter "Get-ProcessMitigation -Name chrome.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).</RawString>
-    </Rule>
-    <Rule id="V-63345" severity="medium" conversionstatus="pass" title="WN10-00-000035" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.
+DEP:
+Enable: ON
 
-The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77201" severity="medium" conversionstatus="pass" title="WN10-EP-000100" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is applicable to unclassified systems; for other systems this is NA.
-
-Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If an application whitelisting program is not in use on the system, this is a finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Configuration of whitelisting applications will vary by the program.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-AppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.
+Enter "Get-ProcessMitigation -Name EXCEL.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If AppLocker is used, perform the following to view the configuration of AppLocker:
-Run "PowerShell".
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system:
-Get-AppLockerPolicy -Effective -XML &gt; c:\temp\file.xml
+DEP:
+Enable: ON
 
-This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.
+ASLR:
+ForceRelocateImages: ON
 
-Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link:
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm</RawString>
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63351" severity="high" conversionstatus="pass" title="WN10-00-000045" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77205" severity="medium" conversionstatus="pass" title="WN10-EP-000110" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If there is no anti-virus solution installed on the system, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-63355" severity="medium" conversionstatus="pass" title="WN10-00-000055" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Allowing other operating systems to run on a secure system may allow security to be circumvented.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Verify the system does not include other operating system installations.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Advanced System Settings".
-Select the "Advanced" tab.
-Click the "Settings" button in the "Startup and Recovery" section.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.</RawString>
+Enter "Get-ProcessMitigation -Name firefox.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have a status of "ON", this is a finding:
+
+DEP:
+Enable: ON
+
+ASLR:
+BottomUp: ON
+ForceRelocateImages: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63357" severity="medium" conversionstatus="pass" title="WN10-00-000060" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77209" severity="medium" conversionstatus="pass" title="WN10-EP-000120" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Non system-created shares should not typically exist on workstations.
-
-If only system-created shares exist on the system this is NA.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Run "Computer Management".
-Navigate to System Tools &gt;&gt; Shared Folders &gt;&gt; Shares.
+This is applicable to unclassified systems, for other systems this is NA.
 
-If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA.
-(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Right click any non-system-created shares.
-Select "Properties".
-Select the "Share Permissions" tab.
+Enter "Get-ProcessMitigation -Name FLTLDR.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Verify the necessity of any shares found.
-If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Select the "Security" tab.
+DEP:
+Enable: ON
 
-If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-63361" severity="high" conversionstatus="pass" title="WN10-00-000070" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.
+ImageLoad:
+BlockRemoteImageLoads: ON
 
-System administrators must log on to systems only using accounts with the minimum level of authority necessary.
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.
+Child Process:
+DisallowChildProcessCreation: ON
 
-Standard user accounts must not be members of the local administrators group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77213" severity="medium" conversionstatus="pass" title="WN10-EP-000130" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
-Review the members of the Administrators group.
-Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Standard user accounts must not be members of the local administrator group.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If prohibited accounts are members of the local administrators group, this is a finding.
+Enter "Get-ProcessMitigation -Name GROOVE.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-The built-in Administrator account or other required administrative accounts would not be a finding.</RawString>
-    </Rule>
-    <Rule id="V-63363" severity="medium" conversionstatus="pass" title="WN10-00-000075" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
-Review the members of the Backup Operators group.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-If the group contains no accounts, this is not a finding.
+DEP:
+Enable: ON
 
-If the group contains any accounts, the accounts must be specifically for backup functions.
+ASLR:
+ForceRelocateImages: ON
 
-If the group contains any standard user accounts used for performing normal user tasks, this is a finding.</RawString>
+ImageLoad:
+BlockRemoteImageLoads: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+Child Process:
+DisallowChildProcessCreation: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63367" severity="low" conversionstatus="pass" title="WN10-00-000085" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77217" severity="medium" conversionstatus="pass" title="WN10-EP-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If local users other than the accounts listed below exist on a workstation in a domain, this is a finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Built-in Administrator account (Disabled)
-Built-in Guest account (Disabled)
-Built-in DefaultAccount (Disabled)
-Built-in defaultuser0 (Disabled)
-Built-in WDAGUtilityAccount (Disabled)
-Local administrator account(s)
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-All of the built-in accounts may not exist on a system, depending on the Windows 10 version.</RawString>
-    </Rule>
-    <Rule id="V-63371" severity="medium" conversionstatus="pass" title="WN10-00-000090" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
-Double click each active account.
+Enter "Get-ProcessMitigation -Name iexplore.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If "Password never expires" is selected for any account, this is a finding.</RawString>
+If the following mitigations do not have a status of "ON", this is a finding:
+
+DEP:
+Enable: ON
+
+ASLR:
+BottomUp: ON
+ForceRelocateImages: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63399" severity="medium" conversionstatus="pass" title="WN10-00-000135" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77221" severity="medium" conversionstatus="pass" title="WN10-EP-000150" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-The configuration requirements will be determined by the applicable firewall STIG.</RawString>
+This is applicable to unclassified systems, for other systems this is NA.
+
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name INFOPATH.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have a status of "ON", this is a finding:
+
+DEP:
+Enable: ON
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63403" severity="medium" conversionstatus="pass" title="WN10-00-000140" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77223" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Review inbound firewall exceptions.
-Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Inbound Rules (this link will be in the right pane)
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.
+Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
+java.exe, javaw.exe, and javaws.exe
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If a third-party firewall is used, ensure comparable settings are in place.</RawString>
+If the following mitigations do not have a status of "ON" for each, this is a finding:
+
+DEP:
+Enable: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63583" severity="medium" conversionstatus="pass" title="WN10-PK-000010" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77227" severity="medium" conversionstatus="pass" title="WN10-EP-000170" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Run "PowerShell" as an administrator.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Execute the following command:
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*ECA*" | FL Subject, Thumbprint, NotAfter
+Enter "Get-ProcessMitigation -Name lync.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+DEP:
+Enable: ON
 
-Subject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US
-Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
-NotAfter: 3/30/2028
+ASLR:
+ForceRelocateImages: ON
 
-Subject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US
-Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
-NotAfter: 12/30/2029
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-Alternately use the Certificates MMC snap-in:
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77231" severity="medium" conversionstatus="pass" title="WN10-EP-000180" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Run "MMC".
+This is applicable to unclassified systems, for other systems this is NA.
 
-Select "File", "Add/Remove Snap-in".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Select "Certificates", click "Add".
+Enter "Get-ProcessMitigation -Name MSACCESS.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Select "Computer account", click "Next".
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Select "Local computer: (the computer this console is running on)", click "Finish".
+DEP:
+Enable: ON
 
-Click "OK".
+ASLR:
+ForceRelocateImages: ON
 
-Expand "Certificates" and navigate to "Trusted Root Certification Authorities &gt;&gt; Certificates".
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-For each of the ECA Root CA certificates noted below:
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77233" severity="medium" conversionstatus="pass" title="WN10-EP-000190" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Right-click on the certificate and select "Open".
+This is applicable to unclassified systems, for other systems this is NA.
 
-Select the "Details" Tab.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Scroll to the bottom and select "Thumbprint".
+Enter "Get-ProcessMitigation -Name MSPUB.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the ECA Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+DEP:
+Enable: ON
 
-ECA Root CA 2
-Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
-Valid to: Thursday, March 30, 2028
+ASLR:
+ForceRelocateImages: ON
 
-ECA Root CA 4
-Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
-Valid to: Sunday, December 30, 2029</RawString>
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63587" severity="medium" conversionstatus="pass" title="WN10-PK-000015" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77235" severity="medium" conversionstatus="pass" title="WN10-EP-000210" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.
-
-Run "PowerShell" as an administrator.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Execute the following command:
+This is applicable to unclassified systems, for other systems this is NA.
 
-Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
+Enter "Get-ProcessMitigation -Name OneDrive.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
-NotAfter: 9/6/2019
+DEP:
+Enable: ON
 
-Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
-NotAfter: 1/22/2022
+ASLR:
+ForceRelocateImages: ON
 
-Alternately use the Certificates MMC snap-in:
+ImageLoad:
+BlockRemoteImageLoads: ON
 
-Run "MMC".
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-Select "File", "Add/Remove Snap-in".
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77239" severity="medium" conversionstatus="pass" title="WN10-EP-000200" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Select "Certificates", click "Add".
+This is applicable to unclassified systems, for other systems this is NA.
 
-Select "Computer account", click "Next".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Select "Local computer: (the computer this console is running on)", click "Finish".
+Enter "Get-ProcessMitigation -Name OIS.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Click "OK".
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
+DEP:
+Enable: ON
 
-For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By":
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-Right-click on the certificate and select "Open".
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77243" severity="medium" conversionstatus="pass" title="WN10-EP-000220" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Select the "Details" Tab.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Scroll to the bottom and select "Thumbprint".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+Enter "Get-ProcessMitigation -Name OUTLOOK.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Issued To: DoD Root CA 2
-Issued By: DoD Interoperability Root CA 1
-Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
-Valid to: Friday, September 6, 2019
+DEP:
+Enable: ON
 
-Issued To: DoD Root CA 3
-Issued By: DoD Interoperability Root CA 2
-Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
-Valid to: Saturday, January 22, 2022</RawString>
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63589" severity="medium" conversionstatus="pass" title="WN10-PK-000020" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77247" severity="medium" conversionstatus="pass" title="WN10-EP-000240" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Run "PowerShell" as an administrator.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Execute the following command:
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter
+Enter "Get-ProcessMitigation -Name POWERPNT.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+DEP:
+Enable: ON
 
-Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
-NotAfter: 9/27/2019
+ASLR:
+ForceRelocateImages: ON
 
-Alternately use the Certificates MMC snap-in:
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-Run "MMC".
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77249" severity="medium" conversionstatus="pass" title="WN10-EP-000250" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Select "File", "Add/Remove Snap-in".
+This is applicable to unclassified systems, for other systems this is NA.
 
-Select "Certificates", click "Add".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Select "Computer account", click "Next".
+Enter "Get-ProcessMitigation -Name PPTVIEW.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Select "Local computer: (the computer this console is running on)", click "Finish".
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Click "OK".
+DEP:
+Enable: ON
 
-Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
+ASLR:
+ForceRelocateImages: ON
 
-For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By":
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-Right-click on the certificate and select "Open".
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77255" severity="medium" conversionstatus="pass" title="WN10-EP-000260" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Select the "Details" tab.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Scroll to the bottom and select "Thumbprint".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+Enter "Get-ProcessMitigation -Name VISIO.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+If the following mitigations do not have a status of "ON", this is a finding:
 
-Issued To: DoD Root CA 3
-Issuer by: US DoD CCEB Interoperability Root CA 2
-Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
-Valid: Friday, September 27, 2019</RawString>
+DEP:
+Enable: ON
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63685" severity="medium" conversionstatus="pass" title="WN10-CC-000210" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77259" severity="medium" conversionstatus="pass" title="WN10-EP-000270" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is applicable to unclassified systems, for other systems this is NA.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If the following registry values do not exist or are not configured as specified, this is a finding:
+This is applicable to unclassified systems, for other systems this is NA.
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Value Name: EnableSmartScreen
+Enter "Get-ProcessMitigation -Name VPREVIEW.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Value Type: REG_DWORD
-Value: 0x00000001 (1)
+If the following mitigations do not have a status of "ON", this is a finding:
 
-And
+DEP:
+Enable: ON
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+ASLR:
+ForceRelocateImages: ON
 
-Value Name: ShellSmartScreenLevel
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-Value Type: REG_SZ
-Value: Block
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77263" severity="medium" conversionstatus="pass" title="WN10-EP-000280" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-v1607 LTSB:
+This is applicable to unclassified systems, for other systems this is NA.
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Value Name: EnableSmartScreen
+Enter "Get-ProcessMitigation -Name WINWORD.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Value Type: REG_DWORD
-Value: 0x00000001 (1)
+If the following mitigations do not have a status of "ON", this is a finding:
 
-v1507 LTSB:
+DEP:
+Enable: ON
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+ASLR:
+ForceRelocateImages: ON
 
-Value Name: EnableSmartScreen
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
 
-Value Type: REG_DWORD
-Value: 0x00000002 (2)</RawString>
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-68845" severity="high" conversionstatus="pass" title="WN10-00-000145" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77267" severity="medium" conversionstatus="pass" title="WN10-EP-000290" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the DEP configuration.
-Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
-Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.)
-If the value for "nx" is not "OptOut", this is a finding.
-(The more restrictive configuration of "AlwaysOn" would not be a finding.)</RawString>
+      <RawString>This is NA prior to v1709 of Windows 10.
+
+This is applicable to unclassified systems, for other systems this is NA.
+
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name wmplayer.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have a status of "ON", this is a finding:
+
+DEP:
+Enable: ON
+
+Payload:
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-72767" severity="medium" conversionstatus="pass" title="WN10-00-000220" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77269" severity="medium" conversionstatus="pass" title="WN10-EP-000300" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA if the system does not have Bluetooth.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-72769" severity="medium" conversionstatus="pass" title="WN10-00-000230" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+This is applicable to unclassified systems, for other systems this is NA.
+
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name wordpad.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have a status of "ON", this is a finding:
+
+DEP:
+Enable: ON
+
+Payload:
+EnableExportAddressFilter: ON
+EnableExportAddressFilterPlus: ON
+EnableImportAddressFilter: ON
+EnableRopStackPivot: ON
+EnableRopCallerCheck: ON
+EnableRopSimExec: ON
+
+The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+  </DocumentRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-63319" severity="medium" conversionstatus="pass" title="WN10-00-000005" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA if the system does not have Bluetooth.
+      <RawString>Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.
 
-Search for "Bluetooth".
-View Bluetooth Settings.
-Select "More Bluetooth Options"
-If "Alert me when a new Bluetooth device wants to connect" is not checked, this is a finding.</RawString>
+For standalone systems, this is NA.
+
+Open "Settings".
+
+Select "System", then "About".
+
+If "Edition" is not "Windows 10 Enterprise", this is a finding.
+
+If "System type" is not "64-bit operating system…", this is a finding.</RawString>
     </Rule>
-    <Rule id="V-76505" severity="medium" conversionstatus="pass" title="WN10-00-000190" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63323" severity="low" conversionstatus="pass" title="WN10-00-000010" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Review the effective User Rights setting in Local Group Policy Editor.
-Run "gpedit.msc".
+      <RawString>Verify domain-joined systems have a TPM enabled and ready for use.
 
-Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
+For standalone systems, this is NA.
 
-Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".)
+Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
 
-If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.</RawString>
+For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+
+Verify the system has a TPM and is ready for use.
+Run "tpm.msc".
+Review the sections in the center pane.
+"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken".
+TPM Manufacturer Information - Specific Version = 2.0 or 1.2
+
+If a TPM is not found or is not ready for use, this is a finding.
+
+NOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.</RawString>
     </Rule>
-    <Rule id="V-77083" severity="medium" conversionstatus="pass" title="WN10-00-000015" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63337" severity="medium" conversionstatus="pass" title="WN10-00-000030" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+      <RawString>Verify all Windows 10 information systems (including SIPRNET) employ BitLocker for full disk encryption.
 
-Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS.
+If full disk encryption using BitLocker is not implemented, this is a finding.
 
-Run "System Information".
+Verify BitLocker is turned on for the operating system drive and any fixed data drives.
 
-Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding.</RawString>
+Open "BitLocker Drive Encryption" from the Control Panel.
+
+If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding.
+
+NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).</RawString>
     </Rule>
-    <Rule id="V-77085" severity="low" conversionstatus="pass" title="WN10-00-000020" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63345" severity="medium" conversionstatus="pass" title="WN10-00-000035" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.
+
+The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled.
+      <RawString>This is applicable to unclassified systems; for other systems this is NA.
 
-For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.
 
-Run "System Information".
+If an application whitelisting program is not in use on the system, this is a finding.
 
-Under "System Summary", if "Secure Boot State" does not display "On", this is finding.</RawString>
+Configuration of whitelisting applications will vary by the program.
+
+AppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.
+
+If AppLocker is used, perform the following to view the configuration of AppLocker:
+Run "PowerShell".
+
+Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system:
+Get-AppLockerPolicy -Effective -XML &gt; c:\temp\file.xml
+
+This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.
+
+Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link:
+
+https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm</RawString>
     </Rule>
-    <Rule id="V-78129" severity="high" conversionstatus="pass" title="WN10-00-000240" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.
+    <Rule id="V-63351" severity="high" conversionstatus="pass" title="WN10-00-000045" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.
 
-Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.
+If there is no anti-virus solution installed on the system, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-63355" severity="medium" conversionstatus="pass" title="WN10-00-000055" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Allowing other operating systems to run on a secure system may allow security to be circumvented.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the system does not include other operating system installations.
 
-The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
+Run "Advanced System Settings".
+Select the "Advanced" tab.
+Click the "Settings" button in the "Startup and Recovery" section.
 
-Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-63357" severity="medium" conversionstatus="pass" title="WN10-00-000060" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.
+      <RawString>Non system-created shares should not typically exist on workstations.
 
-The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
+If only system-created shares exist on the system this is NA.
 
-Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet.
+Run "Computer Management".
+Navigate to System Tools &gt;&gt; Shared Folders &gt;&gt; Shares.
 
-If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.</RawString>
+If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA.
+(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)
+
+Right click any non-system-created shares.
+Select "Properties".
+Select the "Share Permissions" tab.
+
+Verify the necessity of any shares found.
+If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.
+
+Select the "Security" tab.
+
+If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.</RawString>
     </Rule>
-  </ManualRule>
-  <PermissionRule dscresourcemodule="AccessControlDsc">
-    <Rule id="V-63373.a" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Authenticated Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Authenticated Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>CreateDirectories,AppendData</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63361" severity="high" conversionstatus="pass" title="WN10-00-000070" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.
+
+System administrators must log on to systems only using accounts with the minimum level of authority necessary.
+
+For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.
+
+Standard user accounts must not be members of the local administrators group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>%SystemDrive%\</Path>
-      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
-If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
-Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
-Viewing in File Explorer:
-Select the "Security" tab, and the "Advanced" button.
-C:\
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-Administrators - Full control - This folder, subfolders and files
-SYSTEM - Full control - This folder, subfolders and files
-Users - Read &amp; execute - This folder, subfolders and files
-Authenticated Users - Modify - Subfolders and files only
-Authenticated Users - Create folders / append data - This folder only
-Alternately use icacls.
-</RawString>
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
+Review the members of the Administrators group.
+Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.
+
+For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.
+
+Standard user accounts must not be members of the local administrator group.
+
+If prohibited accounts are members of the local administrators group, this is a finding.
+
+The built-in Administrator account or other required administrative accounts would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-63373.b" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>TrustedInstaller</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder and subfolders</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>%ProgramFiles%</Path>
-      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
-If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
-Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
-Viewing in File Explorer:
-Select the "Security" tab, and the "Advanced" button.
-\Program Files
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-TrustedInstaller - Full control - This folder and subfolders
-SYSTEM - Modify - This folder only
-SYSTEM - Full control - Subfolders and files only
-Administrators - Modify - This folder only
-Administrators - Full control - Subfolders and files only
-Users - Read &amp; execute - This folder, subfolders and files
-CREATOR OWNER - Full control - Subfolders and files only
-ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-Alternately use icacls.
-</RawString>
-    </Rule>
-    <Rule id="V-63373.c" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>TrustedInstaller</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder and subfolders</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>%Windir%</Path>
-      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
-If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
-Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
-Viewing in File Explorer:
-Select the "Security" tab, and the "Advanced" button.
-\Windows
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-TrustedInstaller - Full control - This folder and subfolders
-SYSTEM - Modify - This folder only
-SYSTEM - Full control - Subfolders and files only
-Administrators - Modify - This folder only
-Administrators - Full control - Subfolders and files only
-Users - Read &amp; execute - This folder, subfolders and files
-CREATOR OWNER - Full control - Subfolders and files only
-ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-Alternately use icacls.
-</RawString>
-    </Rule>
-    <Rule id="V-63533" severity="medium" conversionstatus="pass" title="WN10-AU-000515" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Eventlog</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Application.evtx</Path>
-      <RawString>Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
-
-Eventlog - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
-
-The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
-
-If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
-
-NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
-    </Rule>
-    <Rule id="V-63537" severity="medium" conversionstatus="pass" title="WN10-AU-000520" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Eventlog</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Security.evtx</Path>
-      <RawString>Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
-
-Eventlog - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
-
-The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
-
-If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
-
-NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
-    </Rule>
-    <Rule id="V-63541" severity="medium" conversionstatus="pass" title="WN10-AU-000525" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Eventlog</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>%windir%\SYSTEM32\WINEVT\LOGS\System.evtx</Path>
-      <RawString>Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
-
-Eventlog - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
-
-The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
-
-If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
-
-NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
-    </Rule>
-    <Rule id="V-63593.a" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>HKLM:\SECURITY</Path>
-      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
-If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
-Run "Regedit".
-Right click on the registry areas noted below.
-Select "Permissions..." and the "Advanced" button.
-HKEY_LOCAL_MACHINE\SECURITY
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-SYSTEM - Full Control - This key and subkeys
-Administrators - Special - This key and subkeys
-Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
-Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
-S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
-If the defaults have not been changed, these are not a finding.
-</RawString>
-    </Rule>
-    <Rule id="V-63593.b" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>HKLM:\SOFTWARE</Path>
-      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
-If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
-Run "Regedit".
-Right click on the registry areas noted below.
-Select "Permissions..." and the "Advanced" button.
-HKEY_LOCAL_MACHINE\SOFTWARE
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-Users - Read - This key and subkeys
-Administrators - Full Control - This key and subkeys
-SYSTEM - Full Control - This key and subkeys
-CREATOR OWNER - Full Control - This key and subkeys
-ALL APPLICATION PACKAGES - Read - This key and subkeys
-Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
-Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
-S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
-If the defaults have not been changed, these are not a finding.
-</RawString>
-    </Rule>
-    <Rule id="V-63593.c" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>HKLM:\SYSTEM</Path>
-      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
-If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
-Run "Regedit".
-Right click on the registry areas noted below.
-Select "Permissions..." and the "Advanced" button.
-HKEY_LOCAL_MACHINE\SYSTEM
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-Users - Read - This key and subkeys
-Administrators - Full Control - This key and subkeys
-SYSTEM - Full Control - This key and subkeys
-CREATOR OWNER - Full Control - This key and subkeys
-ALL APPLICATION PACKAGES - Read - This key and subkeys
-Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
-Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
-S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
-If the defaults have not been changed, these are not a finding.
-</RawString>
-    </Rule>
-  </PermissionRule>
-  <ProcessMitigationRule dscresourcemodule="WindowsDefenderDsc">
-    <Rule id="V-77091" severity="medium" conversionstatus="pass" title="WN10-EP-000020" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63363" severity="medium" conversionstatus="pass" title="WN10-00-000075" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
+Review the members of the Backup Operators group.
 
-Enter "Get-ProcessMitigation -System".
+If the group contains no accounts, this is not a finding.
 
-If the status of "DEP: Enable" is "OFF", this is a finding.
+If the group contains any accounts, the accounts must be specifically for backup functions.
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
+If the group contains any standard user accounts used for performing normal user tasks, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77095" severity="medium" conversionstatus="pass" title="WN10-EP-000030" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63367" severity="low" conversionstatus="pass" title="WN10-00-000085" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>BottomUp</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
 
-Enter "Get-ProcessMitigation -System".
+If local users other than the accounts listed below exist on a workstation in a domain, this is a finding.
 
-If the status of "ASLR: BottomUp" is "OFF", this is a finding.
+Built-in Administrator account (Disabled)
+Built-in Guest account (Disabled)
+Built-in DefaultAccount (Disabled)
+Built-in defaultuser0 (Disabled)
+Built-in WDAGUtilityAccount (Disabled)
+Local administrator account(s)
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
+All of the built-in accounts may not exist on a system, depending on the Windows 10 version.</RawString>
     </Rule>
-    <Rule id="V-77097" severity="medium" conversionstatus="pass" title="WN10-EP-000040" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63371" severity="medium" conversionstatus="pass" title="WN10-00-000090" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>CFG</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -System".
-
-If the status of "CFG: Enable" is "OFF", this is a finding.
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
+Double click each active account.
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
+If "Password never expires" is selected for any account, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77101" severity="medium" conversionstatus="pass" title="WN10-EP-000050" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63399" severity="medium" conversionstatus="pass" title="WN10-00-000135" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>SEHOP</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -System".
-
-If the status of "SEHOP: Enable" is "OFF", this is a finding.
+      <RawString>Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
+The configuration requirements will be determined by the applicable firewall STIG.</RawString>
     </Rule>
-    <Rule id="V-77103" severity="medium" conversionstatus="pass" title="WN10-EP-000060" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63403" severity="medium" conversionstatus="pass" title="WN10-00-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>TerminateOnError</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
+      <RawString>Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.
 
-Enter "Get-ProcessMitigation -System".
+Review inbound firewall exceptions.
+Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Inbound Rules (this link will be in the right pane)
 
-If the status of "Heap: TerminateOnError" is "OFF", this is a finding.
+For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
+If a third-party firewall is used, ensure comparable settings are in place.</RawString>
     </Rule>
-    <Rule id="V-77189" severity="medium" conversionstatus="pass" title="WN10-EP-000070" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63583" severity="medium" conversionstatus="pass" title="WN10-PK-000010" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>Acrobat.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.
 
-This is applicable to unclassified systems, for other systems this is NA.
+Run "PowerShell" as an administrator.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Execute the following command:
 
-Enter "Get-ProcessMitigation -Name Acrobat.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*ECA*" | FL Subject, Thumbprint, NotAfter
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding.
 
-DEP:
-Enable: ON
+If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
 
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+Subject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US
+Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
+NotAfter: 3/30/2028
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Subject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US
+Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
+NotAfter: 12/30/2029
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77191" severity="medium" conversionstatus="pass" title="WN10-EP-000080" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>AcroRd32.exe</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Alternately use the Certificates MMC snap-in:
 
-This is applicable to unclassified systems, for other systems this is NA.
+Run "MMC".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Select "File", "Add/Remove Snap-in".
 
-Enter "Get-ProcessMitigation -Name AcroRd32.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Select "Certificates", click "Add".
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Select "Computer account", click "Next".
 
-DEP:
-Enable: ON
+Select "Local computer: (the computer this console is running on)", click "Finish".
 
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+Click "OK".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Expand "Certificates" and navigate to "Trusted Root Certification Authorities &gt;&gt; Certificates".
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77195" severity="medium" conversionstatus="pass" title="WN10-EP-000090" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>chrome.exe</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+For each of the ECA Root CA certificates noted below:
 
-This is applicable to unclassified systems, for other systems this is NA.
+Right-click on the certificate and select "Open".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Select the "Details" Tab.
 
-Enter "Get-ProcessMitigation -Name chrome.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Scroll to the bottom and select "Thumbprint".
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the ECA Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
 
-DEP:
-Enable: ON
+If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+ECA Root CA 2
+Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
+Valid to: Thursday, March 30, 2028
+
+ECA Root CA 4
+Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
+Valid to: Sunday, December 30, 2029</RawString>
     </Rule>
-    <Rule id="V-77201" severity="medium" conversionstatus="pass" title="WN10-EP-000100" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63587" severity="medium" conversionstatus="pass" title="WN10-PK-000015" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>EXCEL.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.
 
-This is applicable to unclassified systems, for other systems this is NA.
+Run "PowerShell" as an administrator.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Execute the following command:
 
-Enter "Get-ProcessMitigation -Name EXCEL.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
 
-DEP:
-Enable: ON
+If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
 
-ASLR:
-ForceRelocateImages: ON
+Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
+NotAfter: 9/6/2019
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
+NotAfter: 1/22/2022
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77205" severity="medium" conversionstatus="pass" title="WN10-EP-000110" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>firefox.exe</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Alternately use the Certificates MMC snap-in:
 
-This is applicable to unclassified systems, for other systems this is NA.
+Run "MMC".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Select "File", "Add/Remove Snap-in".
 
-Enter "Get-ProcessMitigation -Name firefox.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Select "Certificates", click "Add".
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Select "Computer account", click "Next".
 
-DEP:
-Enable: ON
+Select "Local computer: (the computer this console is running on)", click "Finish".
 
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+Click "OK".
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
+
+For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By":
+
+Right-click on the certificate and select "Open".
+
+Select the "Details" Tab.
+
+Scroll to the bottom and select "Thumbprint".
+
+If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+
+If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+
+Issued To: DoD Root CA 2
+Issued By: DoD Interoperability Root CA 1
+Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
+Valid to: Friday, September 6, 2019
+
+Issued To: DoD Root CA 3
+Issued By: DoD Interoperability Root CA 2
+Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
+Valid to: Saturday, January 22, 2022</RawString>
     </Rule>
-    <Rule id="V-77209" severity="medium" conversionstatus="pass" title="WN10-EP-000120" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63589" severity="medium" conversionstatus="pass" title="WN10-PK-000020" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>FLTLDR.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.
 
-This is applicable to unclassified systems, for other systems this is NA.
+Run "PowerShell" as an administrator.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Execute the following command:
 
-Enter "Get-ProcessMitigation -Name FLTLDR.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter
 
-If the following mitigations do not have a status of "ON", this is a finding:
+If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
 
-DEP:
-Enable: ON
+If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
 
-ImageLoad:
-BlockRemoteImageLoads: ON
+Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
+NotAfter: 9/27/2019
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Alternately use the Certificates MMC snap-in:
 
-Child Process:
-DisallowChildProcessCreation: ON
+Run "MMC".
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77213" severity="medium" conversionstatus="pass" title="WN10-EP-000130" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>GROOVE.EXE</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Select "File", "Add/Remove Snap-in".
 
-This is applicable to unclassified systems, for other systems this is NA.
+Select "Certificates", click "Add".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Select "Computer account", click "Next".
 
-Enter "Get-ProcessMitigation -Name GROOVE.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Select "Local computer: (the computer this console is running on)", click "Finish".
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Click "OK".
 
-DEP:
-Enable: ON
+Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
 
-ASLR:
-ForceRelocateImages: ON
+For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By":
 
-ImageLoad:
-BlockRemoteImageLoads: ON
+Right-click on the certificate and select "Open".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Select the "Details" tab.
 
-Child Process:
-DisallowChildProcessCreation: ON
+Scroll to the bottom and select "Thumbprint".
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+
+If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+
+Issued To: DoD Root CA 3
+Issuer by: US DoD CCEB Interoperability Root CA 2
+Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
+Valid: Friday, September 27, 2019</RawString>
     </Rule>
-    <Rule id="V-77217" severity="medium" conversionstatus="pass" title="WN10-EP-000140" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63685" severity="medium" conversionstatus="pass" title="WN10-CC-000210" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>iexplore.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>This is applicable to unclassified systems, for other systems this is NA.
 
-This is applicable to unclassified systems, for other systems this is NA.
+If the following registry values do not exist or are not configured as specified, this is a finding:
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
 
-Enter "Get-ProcessMitigation -Name iexplore.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Value Name: EnableSmartScreen
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Value Type: REG_DWORD
+Value: 0x00000001 (1)
 
-DEP:
-Enable: ON
+And
 
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Value Name: ShellSmartScreenLevel
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77221" severity="medium" conversionstatus="pass" title="WN10-EP-000150" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>INFOPATH.EXE</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Value Type: REG_SZ
+Value: Block
 
-This is applicable to unclassified systems, for other systems this is NA.
+v1607 LTSB:
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
 
-Enter "Get-ProcessMitigation -Name INFOPATH.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Value Name: EnableSmartScreen
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Value Type: REG_DWORD
+Value: 0x00000001 (1)
 
-DEP:
-Enable: ON
+v1507 LTSB:
 
-ASLR:
-ForceRelocateImages: ON
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Value Name: EnableSmartScreen
+
+Value Type: REG_DWORD
+Value: 0x00000002 (2)</RawString>
+    </Rule>
+    <Rule id="V-68845" severity="high" conversionstatus="pass" title="WN10-00-000145" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the DEP configuration.
+Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
+Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.)
+If the value for "nx" is not "OptOut", this is a finding.
+(The more restrictive configuration of "AlwaysOn" would not be a finding.)</RawString>
+    </Rule>
+    <Rule id="V-72767" severity="medium" conversionstatus="pass" title="WN10-00-000220" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA if the system does not have Bluetooth.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77223.a" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-72769" severity="medium" conversionstatus="pass" title="WN10-00-000230" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>java.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>This is NA if the system does not have Bluetooth.
 
-This is applicable to unclassified systems, for other systems this is NA.
+Search for "Bluetooth".
+View Bluetooth Settings.
+Select "More Bluetooth Options"
+If "Alert me when a new Bluetooth device wants to connect" is not checked, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-76505" severity="medium" conversionstatus="pass" title="WN10-00-000190" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review the effective User Rights setting in Local Group Policy Editor.
+Run "gpedit.msc".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
 
-Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
-java.exe, javaw.exe, and javaws.exe
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".)
 
-If the following mitigations do not have a status of "ON" for each, this is a finding:
+If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-77083" severity="medium" conversionstatus="pass" title="WN10-00-000015" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
 
-DEP:
-Enable: ON
+Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Run "System Information".
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding.</RawString>
     </Rule>
-    <Rule id="V-77223.b" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-77085" severity="low" conversionstatus="pass" title="WN10-00-000020" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>javaw.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
+      <RawString>Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
 
-Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
-java.exe, javaw.exe, and javaws.exe
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Run "System Information".
 
-If the following mitigations do not have a status of "ON" for each, this is a finding:
+Under "System Summary", if "Secure Boot State" does not display "On", this is finding.</RawString>
+    </Rule>
+    <Rule id="V-78129" severity="high" conversionstatus="pass" title="WN10-00-000240" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.
 
-DEP:
-Enable: ON
+Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77223.c" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>javaws.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
-java.exe, javaw.exe, and javaws.exe
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON" for each, this is a finding:
+      <RawString>Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.
 
-DEP:
-Enable: ON
+The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77227" severity="medium" conversionstatus="pass" title="WN10-EP-000170" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+  </ManualRule>
+  <PermissionRule dscresourcemodule="AccessControlDsc">
+    <Rule id="V-63373.a" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Authenticated Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Authenticated Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>CreateDirectories,AppendData</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Force>True</Force>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Path>%SystemDrive%\</Path>
+      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
+If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
+Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
+Viewing in File Explorer:
+Select the "Security" tab, and the "Advanced" button.
+C:\
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+Administrators - Full control - This folder, subfolders and files
+SYSTEM - Full control - This folder, subfolders and files
+Users - Read &amp; execute - This folder, subfolders and files
+Authenticated Users - Modify - Subfolders and files only
+Authenticated Users - Create folders / append data - This folder only
+Alternately use icacls.
+</RawString>
+    </Rule>
+    <Rule id="V-63373.b" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>TrustedInstaller</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder and subfolders</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>lync.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name lync.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>%ProgramFiles%</Path>
+      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
+If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
+Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
+Viewing in File Explorer:
+Select the "Security" tab, and the "Advanced" button.
+\Program Files
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+TrustedInstaller - Full control - This folder and subfolders
+SYSTEM - Modify - This folder only
+SYSTEM - Full control - Subfolders and files only
+Administrators - Modify - This folder only
+Administrators - Full control - Subfolders and files only
+Users - Read &amp; execute - This folder, subfolders and files
+CREATOR OWNER - Full control - Subfolders and files only
+ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+Alternately use icacls.
+</RawString>
     </Rule>
-    <Rule id="V-77231" severity="medium" conversionstatus="pass" title="WN10-EP-000180" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63373.c" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>TrustedInstaller</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder and subfolders</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>MSACCESS.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name MSACCESS.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>%Windir%</Path>
+      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
+If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
+Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
+Viewing in File Explorer:
+Select the "Security" tab, and the "Advanced" button.
+\Windows
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+TrustedInstaller - Full control - This folder and subfolders
+SYSTEM - Modify - This folder only
+SYSTEM - Full control - Subfolders and files only
+Administrators - Modify - This folder only
+Administrators - Full control - Subfolders and files only
+Users - Read &amp; execute - This folder, subfolders and files
+CREATOR OWNER - Full control - Subfolders and files only
+ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+Alternately use icacls.
+</RawString>
     </Rule>
-    <Rule id="V-77233" severity="medium" conversionstatus="pass" title="WN10-EP-000190" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63533" severity="medium" conversionstatus="pass" title="WN10-AU-000515" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Eventlog</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>MSPUB.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name MSPUB.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Application.evtx</Path>
+      <RawString>Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
 
-DEP:
-Enable: ON
+Eventlog - Full Control
+SYSTEM - Full Control
+Administrators - Full Control
 
-ASLR:
-ForceRelocateImages: ON
+The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-77235" severity="medium" conversionstatus="pass" title="WN10-EP-000210" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63537" severity="medium" conversionstatus="pass" title="WN10-AU-000520" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Eventlog</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>OneDrive.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name OneDrive.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
+      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Security.evtx</Path>
+      <RawString>Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
 
-ASLR:
-ForceRelocateImages: ON
+Eventlog - Full Control
+SYSTEM - Full Control
+Administrators - Full Control
 
-ImageLoad:
-BlockRemoteImageLoads: ON
+The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-77239" severity="medium" conversionstatus="pass" title="WN10-EP-000200" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63541" severity="medium" conversionstatus="pass" title="WN10-AU-000525" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Eventlog</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>OIS.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name OIS.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+      <Path>%windir%\SYSTEM32\WINEVT\LOGS\System.evtx</Path>
+      <RawString>Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Eventlog - Full Control
+SYSTEM - Full Control
+Administrators - Full Control
 
-DEP:
-Enable: ON
+The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-77243" severity="medium" conversionstatus="pass" title="WN10-EP-000220" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63593.a" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>OUTLOOK.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name OUTLOOK.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>HKLM:\SECURITY</Path>
+      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
+If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
+Run "Regedit".
+Right click on the registry areas noted below.
+Select "Permissions..." and the "Advanced" button.
+HKEY_LOCAL_MACHINE\SECURITY
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+SYSTEM - Full Control - This key and subkeys
+Administrators - Special - This key and subkeys
+Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
+Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
+S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
+If the defaults have not been changed, these are not a finding.
+</RawString>
     </Rule>
-    <Rule id="V-77245" severity="medium" conversionstatus="pass" title="WN10-EP-000230" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63593.b" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>plugin-container.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name plugin-container.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>HKLM:\SOFTWARE</Path>
+      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
+If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
+Run "Regedit".
+Right click on the registry areas noted below.
+Select "Permissions..." and the "Advanced" button.
+HKEY_LOCAL_MACHINE\SOFTWARE
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+Users - Read - This key and subkeys
+Administrators - Full Control - This key and subkeys
+SYSTEM - Full Control - This key and subkeys
+CREATOR OWNER - Full Control - This key and subkeys
+ALL APPLICATION PACKAGES - Read - This key and subkeys
+Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
+Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
+S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
+If the defaults have not been changed, these are not a finding.
+</RawString>
     </Rule>
-    <Rule id="V-77247" severity="medium" conversionstatus="pass" title="WN10-EP-000240" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63593.c" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>POWERPNT.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name POWERPNT.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>HKLM:\SYSTEM</Path>
+      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
+If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
+Run "Regedit".
+Right click on the registry areas noted below.
+Select "Permissions..." and the "Advanced" button.
+HKEY_LOCAL_MACHINE\SYSTEM
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+Users - Read - This key and subkeys
+Administrators - Full Control - This key and subkeys
+SYSTEM - Full Control - This key and subkeys
+CREATOR OWNER - Full Control - This key and subkeys
+ALL APPLICATION PACKAGES - Read - This key and subkeys
+Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
+Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
+S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
+If the defaults have not been changed, these are not a finding.
+</RawString>
     </Rule>
-    <Rule id="V-77249" severity="medium" conversionstatus="pass" title="WN10-EP-000250" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+  </PermissionRule>
+  <ProcessMitigationRule dscresourcemodule="WindowsDefenderDsc">
+    <Rule id="V-77091" severity="medium" conversionstatus="pass" title="WN10-EP-000020" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>DEP</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>PPTVIEW.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name PPTVIEW.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "DEP: Enable" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77255" severity="medium" conversionstatus="pass" title="WN10-EP-000260" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77095" severity="medium" conversionstatus="pass" title="WN10-EP-000030" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>BottomUp</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>VISIO.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name VISIO.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "ASLR: BottomUp" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77259" severity="medium" conversionstatus="pass" title="WN10-EP-000270" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77097" severity="medium" conversionstatus="pass" title="WN10-EP-000040" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>CFG</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>VPREVIEW.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name VPREVIEW.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "CFG: Enable" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77263" severity="medium" conversionstatus="pass" title="WN10-EP-000280" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77101" severity="medium" conversionstatus="pass" title="WN10-EP-000050" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>SEHOP</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>WINWORD.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name WINWORD.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "SEHOP: Enable" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77267" severity="medium" conversionstatus="pass" title="WN10-EP-000290" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77103" severity="medium" conversionstatus="pass" title="WN10-EP-000060" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>TerminateOnError</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>wmplayer.exe</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name wmplayer.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-DEP:
-Enable: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "Heap: TerminateOnError" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77269" severity="medium" conversionstatus="pass" title="WN10-EP-000300" dscresource="ProcessMitigation">
+    <Rule id="V-77245" severity="medium" conversionstatus="pass" title="WN10-EP-000230" dscresource="ProcessMitigation">
       <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
       <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>wordpad.exe</MitigationTarget>
+      <MitigationTarget>plugin-container.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
@@ -3320,7 +3183,7 @@ This is applicable to unclassified systems, for other systems this is NA.
 
 Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Enter "Get-ProcessMitigation -Name wordpad.exe".
+Enter "Get-ProcessMitigation -Name plugin-container.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
 If the following mitigations do not have a status of "ON", this is a finding:
@@ -6356,7 +6219,7 @@ Value: 0x00000001 (1)</RawString>
       <DuplicateOf />
       <Ensure>Present</Ensure>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\</Key>
+      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE</Key>
       <OrganizationValueRequired>True</OrganizationValueRequired>
       <OrganizationValueTestString>ValueData is set to 0x00000006 (6) or greater </OrganizationValueTestString>
       <RawString>If the following registry value does not exist or is not configured as specified, this is a finding.
diff --git a/StigData/Processed/WindowsClient-10-1.18.org.default.xml b/source/StigData/Processed/WindowsClient-10-1.21.org.default.xml
similarity index 96%
rename from StigData/Processed/WindowsClient-10-1.18.org.default.xml
rename to source/StigData/Processed/WindowsClient-10-1.21.org.default.xml
index a0a3a061e..8f9bfbf20 100644
--- a/StigData/Processed/WindowsClient-10-1.18.org.default.xml
+++ b/source/StigData/Processed/WindowsClient-10-1.21.org.default.xml
@@ -5,7 +5,7 @@
     Each setting in this file is linked by STIG ID and the valid range is in an
     associated comment.
 -->
-<OrganizationalSettings fullversion="1.18">
+<OrganizationalSettings fullversion="1.21">
   <!-- Ensure ''V-63329'' -match '0|ShouldBeAbsent'-->
   <OrganizationalSetting id="V-63329" ValueData="0" />
   <!-- Ensure ''V-63405'' -ge '15' -or ''V-63405'' -eq '0'-->
@@ -32,7 +32,7 @@
   <OrganizationalSetting id="V-63581" ValueData="1" />
   <!-- Ensure ''V-63595.b'' -match '1|3'-->
   <OrganizationalSetting id="V-63595.b" ValueData="1" />
-  <!-- Ensure ''V-63607'' -match '1|3|8|ShouldBeAbsent'-->
+  <!-- Ensure ''V-63607'' -match '1|3|8'-->
   <OrganizationalSetting id="V-63607" ValueData="1" />
   <!-- Ensure ''V-63619'' -ne 'Administrator'-->
   <OrganizationalSetting id="V-63619" OptionValue="" />
diff --git a/StigData/Processed/WindowsClient-10-1.18.xml b/source/StigData/Processed/WindowsClient-10-1.21.xml
similarity index 93%
rename from StigData/Processed/WindowsClient-10-1.18.xml
rename to source/StigData/Processed/WindowsClient-10-1.21.xml
index 29914f71a..fb9a02f16 100644
--- a/StigData/Processed/WindowsClient-10-1.18.xml
+++ b/source/StigData/Processed/WindowsClient-10-1.21.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Windows_10_STIG" description="The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_10_STIG_V1R18_Manual-xccdf.xml" releaseinfo="Release: 18 Benchmark Date: 26 Jul 2019" title="Windows 10 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.18" created="11/8/2019">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Windows_10_STIG" description="The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_10_STIG_V1R21_Manual-xccdf.xml" releaseinfo="Release: 21 Benchmark Date: 24 Apr 2020" title="Windows 10 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.21" created="6/17/2020">
   <AccountPolicyRule dscresourcemodule="SecurityPolicyDsc">
     <Rule id="V-63405" severity="medium" conversionstatus="pass" title="WN10-AC-000005" dscresource="AccountPolicy">
       <Description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.   This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -183,27 +183,6 @@ Compare the AuditPol settings with the following.  If the system does not audit
 Account Logon &gt;&gt; Credential Validation - Success</RawString>
       <Subcategory>Credential Validation</Subcategory>
     </Rule>
-    <Rule id="V-63441" severity="medium" conversionstatus="pass" title="WN10-AU-000020" dscresource="AuditPolicySubcategory">
-      <AuditFlag>Success</AuditFlag>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-Other Account Management records events such as the access of a password hash or the Password Policy Checking API being called.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*".
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
-
-Account Management &gt;&gt; Other Account Management Events - Success</RawString>
-      <Subcategory>Other Account Management Events</Subcategory>
-    </Rule>
     <Rule id="V-63445" severity="medium" conversionstatus="pass" title="WN10-AU-000030" dscresource="AuditPolicySubcategory">
       <AuditFlag>Success</AuditFlag>
       <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
@@ -277,7 +256,7 @@ Plug and Play activity records events related to the successful connection of ex
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 
 
 Use the AuditPol tool to review the current Audit Policy configuration:
 Open a Command Prompt with elevated privileges ("Run as Administrator").
@@ -309,27 +288,6 @@ Compare the AuditPol settings with the following.  If the system does not audit
 Detailed Tracking &gt;&gt; Process Creation - Success</RawString>
       <Subcategory>Process Creation</Subcategory>
     </Rule>
-    <Rule id="V-63455" severity="medium" conversionstatus="pass" title="WN10-AU-000055" dscresource="AuditPolicySubcategory">
-      <AuditFlag>Success</AuditFlag>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-Account Lockout events can be used to identify potentially malicious logon attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*"
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
-
-Logon/Logoff &gt;&gt; Account Lockout - Success</RawString>
-      <Subcategory>Account Lockout</Subcategory>
-    </Rule>
     <Rule id="V-63457" severity="medium" conversionstatus="pass" title="WN10-AU-000060" dscresource="AuditPolicySubcategory">
       <AuditFlag>Success</AuditFlag>
       <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
@@ -340,7 +298,7 @@ Audit Group Membership records information related to the group membership of a
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 
 
 Use the AuditPol tool to review the current Audit Policy configuration:
 Open a Command Prompt with elevated privileges ("Run as Administrator").
@@ -481,27 +439,6 @@ Object Access &gt;&gt; Removable Storage - Success
 Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.</RawString>
       <Subcategory>Removable Storage</Subcategory>
     </Rule>
-    <Rule id="V-63475" severity="medium" conversionstatus="pass" title="WN10-AU-000095" dscresource="AuditPolicySubcategory">
-      <AuditFlag>Failure</AuditFlag>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-Audit Policy Change records events related to changes in audit policy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*".
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:
-
-Policy Change &gt;&gt; Audit Policy Change - Failure</RawString>
-      <Subcategory>Audit Policy Change</Subcategory>
-    </Rule>
     <Rule id="V-63479" severity="medium" conversionstatus="pass" title="WN10-AU-000100" dscresource="AuditPolicySubcategory">
       <AuditFlag>Success</AuditFlag>
       <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
@@ -607,27 +544,6 @@ Compare the AuditPol settings with the following.  If the system does not audit
 System &gt;&gt; IPSec Driver - Failure</RawString>
       <Subcategory>IPSec Driver</Subcategory>
     </Rule>
-    <Rule id="V-63495" severity="medium" conversionstatus="pass" title="WN10-AU-000125" dscresource="AuditPolicySubcategory">
-      <AuditFlag>Success</AuditFlag>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
-
-IPSec Driver records events related to the IPSec Driver such as dropped packets.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
-
-Use the AuditPol tool to review the current Audit Policy configuration:
-Open a Command Prompt with elevated privileges ("Run as Administrator").
-Enter "AuditPol /get /category:*".
-
-Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:"
-
-System &gt;&gt; IPSec Driver - Success</RawString>
-      <Subcategory>IPSec Driver</Subcategory>
-    </Rule>
     <Rule id="V-63499" severity="medium" conversionstatus="pass" title="WN10-AU-000130" dscresource="AuditPolicySubcategory">
       <AuditFlag>Success</AuditFlag>
       <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
@@ -638,7 +554,7 @@ Audit Other System Events records information related to cryptographic key opera
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 
 
 Use the AuditPol tool to review the current Audit Policy configuration:
 Open a Command Prompt with elevated privileges ("Run as Administrator").
@@ -659,7 +575,7 @@ Audit Other System Events records information related to cryptographic key opera
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 
 
 Use the AuditPol tool to review the current Audit Policy configuration:
 Open a Command Prompt with elevated privileges ("Run as Administrator").
@@ -787,7 +703,7 @@ Authorization Policy Change records events related to changes in user rights, su
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 
 
 Use the AuditPol tool to review the current Audit Policy configuration:
 -Open a Command Prompt with elevated privileges ("Run as Administrator").
@@ -897,6 +813,168 @@ Object Access &gt;&gt; File Share - Failure
 If the system does not audit the above, this is a finding.</RawString>
       <Subcategory>File Share</Subcategory>
     </Rule>
+    <Rule id="V-99541" severity="medium" conversionstatus="pass" title="WN10-AU-000565" dscresource="AuditPolicySubcategory">
+      <AuditFlag>Failure</AuditFlag>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Logon/Logoff  &gt;&gt; Other Logon/Logoff Events - Failure
+</RawString>
+      <Subcategory>Other Logon/Logoff Events</Subcategory>
+    </Rule>
+    <Rule id="V-99543" severity="medium" conversionstatus="pass" title="WN10-AU-000560" dscresource="AuditPolicySubcategory">
+      <AuditFlag>Success</AuditFlag>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Logon/Logoff  &gt;&gt; Other Logon/Logoff Events - Success
+</RawString>
+      <Subcategory>Other Logon/Logoff Events</Subcategory>
+    </Rule>
+    <Rule id="V-99545" severity="medium" conversionstatus="pass" title="WN10-AU-000570" dscresource="AuditPolicySubcategory">
+      <AuditFlag>Failure</AuditFlag>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Detailed File Share allows you to audit attempts to access files and folders on a shared folder.
+The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Object Access  &gt;&gt; Detailed File Share - Failure
+</RawString>
+      <Subcategory>Detailed File Share</Subcategory>
+    </Rule>
+    <Rule id="V-99547" severity="medium" conversionstatus="pass" title="WN10-AU-000575" dscresource="AuditPolicySubcategory">
+      <AuditFlag>Success</AuditFlag>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). 
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; MPSSVC Rule-Level Policy Change - Success
+</RawString>
+      <Subcategory>MPSSVC Rule-Level Policy Change</Subcategory>
+    </Rule>
+    <Rule id="V-99549" severity="medium" conversionstatus="pass" title="WN10-AU-000580" dscresource="AuditPolicySubcategory">
+      <AuditFlag>Failure</AuditFlag>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). 
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; MPSSVC Rule-Level Policy Change - Failure
+</RawString>
+      <Subcategory>MPSSVC Rule-Level Policy Change</Subcategory>
+    </Rule>
+    <Rule id="V-99551" severity="medium" conversionstatus="pass" title="WN10-AU-000550" dscresource="AuditPolicySubcategory">
+      <AuditFlag>Success</AuditFlag>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; Other Policy Change Events - Success
+</RawString>
+      <Subcategory>Other Policy Change Events</Subcategory>
+    </Rule>
+    <Rule id="V-99553" severity="medium" conversionstatus="pass" title="WN10-AU-000555" dscresource="AuditPolicySubcategory">
+      <AuditFlag>Failure</AuditFlag>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.
+
+Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.
+
+Use the AuditPol tool to review the current Audit Policy configuration:
+Open a Command Prompt with elevated privileges ("Run as Administrator").
+Enter "AuditPol /get /category:*".
+
+Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:
+
+Policy Change  &gt;&gt; Other Policy Change Events - Failure
+</RawString>
+      <Subcategory>Other Policy Change Events</Subcategory>
+    </Rule>
   </AuditPolicyRule>
   <AuditSettingRule dscresourcemodule="AuditSystemDsc">
     <Rule id="V-63349" severity="high" conversionstatus="pass" title="WN10-00-000040" dscresource="AuditSetting">
@@ -905,7 +983,7 @@ If the system does not audit the above, this is a finding.</RawString>
 New versions with feature updates are planned to be released on a semi-annual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions.
 
 A separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DesiredValue>10.0.15063</DesiredValue>
+      <DesiredValue>10.0.16299</DesiredValue>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <Operator>-le</Operator>
@@ -917,7 +995,7 @@ A separate servicing branch intended for special purpose systems is the Long-Ter
 
 If the "About Windows" dialog box does not display:
 
-"Microsoft Windows Version 1703 (OS Build 15063.0)"
+"Microsoft Windows Version 1709 (OS Build 16299.0)"
 
 or greater, this is a finding.
 
@@ -987,7 +1065,7 @@ Copy the lines below to the PowerShell window and enter.
    if ($lastLogin -eq $null) {
       $lastLogin = 'Never'
    }
-   Write-Host $user.Name $lastLogin $enabled
+   Write-Host $user.Name $lastLogin $enabled 
 }"
 
 This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False).
@@ -1053,7 +1131,7 @@ Execute the following command:
 
 Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter
 
-If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding.
+If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. 
 
 If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
 
@@ -1129,2189 +1207,2087 @@ Verify the Bluetooth radio is turned off unless approved by the organization. If
 
 Approval must be documented with the ISSO.</RawString>
     </Rule>
-  </DocumentRule>
-  <ManualRule dscresourcemodule="None">
-    <Rule id="V-63319" severity="medium" conversionstatus="pass" title="WN10-00-000005" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77189" severity="medium" conversionstatus="pass" title="WN10-EP-000070" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-For standalone systems, this is NA.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Open "Settings".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Select "System", then "About".
+Enter "Get-ProcessMitigation -Name Acrobat.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If "Edition" is not "Windows 10 Enterprise", this is a finding.
+If the following mitigations do not have the listed status which is shown below, this is a finding
 
-If "System type" is not "64-bit operating system…", this is a finding.</RawString>
+DEP:
+OverrideDEP: False
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63323" severity="low" conversionstatus="pass" title="WN10-00-000010" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77191" severity="medium" conversionstatus="pass" title="WN10-EP-000080" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify domain-joined systems have a TPM enabled and ready for use.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-For standalone systems, this is NA.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+Enter "Get-ProcessMitigation -Name AcroRd32.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Verify the system has a TPM and is ready for use.
-Run "tpm.msc".
-Review the sections in the center pane.
-"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken".
-TPM Manufacturer Information - Specific Version = 2.0 or 1.2
+If the following mitigations do not have the listed status which is shown below, this is a finding:
+
+DEP:
+OverrideDEP: False
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot= False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-If a TPM is not found or is not ready for use, this is a finding.
 
-NOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.</RawString>
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63337" severity="medium" conversionstatus="pass" title="WN10-00-000030" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77195" severity="medium" conversionstatus="pass" title="WN10-EP-000090" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify all Windows 10 information systems (including SIPRNET) employ BitLocker for full disk encryption.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If full disk encryption using BitLocker is not implemented, this is a finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Verify BitLocker is turned on for the operating system drive and any fixed data drives.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Open "BitLocker Drive Encryption" from the Control Panel.
+Enter "Get-ProcessMitigation -Name chrome.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding.
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).</RawString>
-    </Rule>
-    <Rule id="V-63345" severity="medium" conversionstatus="pass" title="WN10-00-000035" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.
+DEP:
+OverrideDEP: False
 
-The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77201" severity="medium" conversionstatus="pass" title="WN10-EP-000100" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is applicable to unclassified systems; for other systems this is NA.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.
+This is applicable to unclassified systems, for other systems this is NA.
 
-If an application whitelisting program is not in use on the system, this is a finding.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Configuration of whitelisting applications will vary by the program.
+Enter "Get-ProcessMitigation -Name EXCEL.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-AppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-If AppLocker is used, perform the following to view the configuration of AppLocker:
-Run "PowerShell".
+DEP:
+OverrideDEP: False
 
-Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system:
-Get-AppLockerPolicy -Effective -XML &gt; c:\temp\file.xml
+ASLR:
+ForceRelocateImages: ON
 
-This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link:
 
-https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm</RawString>
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63351" severity="high" conversionstatus="pass" title="WN10-00-000045" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77205" severity="medium" conversionstatus="pass" title="WN10-EP-000110" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If there is no anti-virus solution installed on the system, this is a finding.</RawString>
+This is applicable to unclassified systems, for other systems this is NA.
+
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name firefox.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+If the following mitigations do not have the listed status which is shown below, this is a finding:
+
+DEP:
+Override DEP: False
+
+ASLR:
+ForceRelocateImages: True
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63355" severity="medium" conversionstatus="pass" title="WN10-00-000055" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Allowing other operating systems to run on a secure system may allow security to be circumvented.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77209" severity="medium" conversionstatus="pass" title="WN10-EP-000120" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the system does not include other operating system installations.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Run "Advanced System Settings".
-Select the "Advanced" tab.
-Click the "Settings" button in the "Startup and Recovery" section.
+This is applicable to unclassified systems, for other systems this is NA.
 
-If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.</RawString>
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name FLTLDR.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have the listed status which is shown below, this is a finding:
+
+DEP:
+Override DEP: False
+
+ImageLoad:
+ImageLoad OverrideBlockRemoteImages: False
+
+Payload:
+OverrideEnableExportAddressFilter: False 
+OverrideEnableExportAddressFilterPlus: False 
+OverrideEnableImportAddressFilter: False 
+OverrideEnableRopStackPivot: False 
+OverrideEnableRopCallerCheck: False 
+OverrideEnableRopSimExec: False
+
+Child Process:
+OverrideChildProcess: False
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63357" severity="medium" conversionstatus="pass" title="WN10-00-000060" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77213" severity="medium" conversionstatus="pass" title="WN10-EP-000130" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Non system-created shares should not typically exist on workstations.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If only system-created shares exist on the system this is NA.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Computer Management".
-Navigate to System Tools &gt;&gt; Shared Folders &gt;&gt; Shares.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA.
-(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)
+Enter "Get-ProcessMitigation -Name GROOVE.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Right click any non-system-created shares.
-Select "Properties".
-Select the "Share Permissions" tab.
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-Verify the necessity of any shares found.
-If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.
+DEP:
+OverrideDEP: False
 
-Select the "Security" tab.
+ASLR:
+ForceRelocateImages: True
 
-If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-63361" severity="high" conversionstatus="pass" title="WN10-00-000070" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.
+ImageLoad:
+OverrideBlockRemoteImages: False
 
-System administrators must log on to systems only using accounts with the minimum level of authority necessary.
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.
+Child Process:
+OverrideChildProcess: False
 
-Standard user accounts must not be members of the local administrators group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+The PowerShell command produces a list of mitigations; only those with a required status are listed here.  If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77217" severity="medium" conversionstatus="pass" title="WN10-EP-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
-Review the members of the Administrators group.
-Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Standard user accounts must not be members of the local administrator group.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If prohibited accounts are members of the local administrators group, this is a finding.
+Enter "Get-ProcessMitigation -Name iexplore.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-The built-in Administrator account or other required administrative accounts would not be a finding.</RawString>
-    </Rule>
-    <Rule id="V-63363" severity="medium" conversionstatus="pass" title="WN10-00-000075" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
-Review the members of the Backup Operators group.
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-If the group contains no accounts, this is not a finding.
+DEP:
+OverrideDEP: False
 
-If the group contains any accounts, the accounts must be specifically for backup functions.
+ASLR:
+ForceRelocateImages: ON
 
-If the group contains any standard user accounts used for performing normal user tasks, this is a finding.</RawString>
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63367" severity="low" conversionstatus="pass" title="WN10-00-000085" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77221" severity="medium" conversionstatus="pass" title="WN10-EP-000150" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If local users other than the accounts listed below exist on a workstation in a domain, this is a finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Built-in Administrator account (Disabled)
-Built-in Guest account (Disabled)
-Built-in DefaultAccount (Disabled)
-Built-in defaultuser0 (Disabled)
-Built-in WDAGUtilityAccount (Disabled)
-Local administrator account(s)
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-All of the built-in accounts may not exist on a system, depending on the Windows 10 version.</RawString>
-    </Rule>
-    <Rule id="V-63371" severity="medium" conversionstatus="pass" title="WN10-00-000090" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Run "Computer Management".
-Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
-Double click each active account.
+Enter "Get-ProcessMitigation -Name INFOPATH.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If "Password never expires" is selected for any account, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-63399" severity="medium" conversionstatus="pass" title="WN10-00-000135" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-The configuration requirements will be determined by the applicable firewall STIG.</RawString>
+DEP:
+OverrideDEP: False
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63403" severity="medium" conversionstatus="pass" title="WN10-00-000140" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77223" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Review inbound firewall exceptions.
-Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Inbound Rules (this link will be in the right pane)
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.
+Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
+java.exe, javaw.exe, and javaws.exe
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If a third-party firewall is used, ensure comparable settings are in place.</RawString>
+If the following mitigations do not have the listed status which is shown below, this is a finding:
+
+DEP:
+OverrideDEP: False
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63583" severity="medium" conversionstatus="pass" title="WN10-PK-000010" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77227" severity="medium" conversionstatus="pass" title="WN10-EP-000170" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Run "PowerShell" as an administrator.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Execute the following command:
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*ECA*" | FL Subject, Thumbprint, NotAfter
+Enter "Get-ProcessMitigation -Name lync.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding.
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+DEP:
+OverrideDEP: False
 
-Subject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US
-Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
-NotAfter: 3/30/2028
+ASLR:
+ForceRelocateImages: ON
 
-Subject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US
-Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
-NotAfter: 12/30/2029
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-Alternately use the Certificates MMC snap-in:
 
-Run "MMC".
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77231" severity="medium" conversionstatus="pass" title="WN10-EP-000180" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Select "File", "Add/Remove Snap-in".
+This is applicable to unclassified systems, for other systems this is NA.
 
-Select "Certificates", click "Add".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Select "Computer account", click "Next".
+Enter "Get-ProcessMitigation -Name MSACCESS.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Select "Local computer: (the computer this console is running on)", click "Finish".
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-Click "OK".
+DEP:
+OverrideDEP: False
 
-Expand "Certificates" and navigate to "Trusted Root Certification Authorities &gt;&gt; Certificates".
+ASLR:
+ForceRelocateImages: ON
 
-For each of the ECA Root CA certificates noted below:
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-Right-click on the certificate and select "Open".
 
-Select the "Details" Tab.
+The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77233" severity="medium" conversionstatus="pass" title="WN10-EP-000190" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Scroll to the bottom and select "Thumbprint".
+This is applicable to unclassified systems, for other systems this is NA.
 
-If the ECA Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+Enter "Get-ProcessMitigation -Name MSPUB.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-ECA Root CA 2
-Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
-Valid to: Thursday, March 30, 2028
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-ECA Root CA 4
-Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
-Valid to: Sunday, December 30, 2029</RawString>
+DEP:
+OverrideDEP: False
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63587" severity="medium" conversionstatus="pass" title="WN10-PK-000015" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77235" severity="medium" conversionstatus="pass" title="WN10-EP-000210" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Run "PowerShell" as an administrator.
+This is applicable to unclassified systems, for other systems this is NA.
 
-Execute the following command:
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter
+Enter "Get-ProcessMitigation -Name OneDrive.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+DEP:
+Override DEP: False
 
-Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
-NotAfter: 9/6/2019
+ASLR:
+OverrideRelocateImages: False
 
-Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
-NotAfter: 1/22/2022
+ImageLoad:
+OverrideBlockRemoteImages: False
 
-Alternately use the Certificates MMC snap-in:
+Payload:
+OverrideEnableExportAddressFilter: False 
+OverrideEnableExportAddressFilterPlus: False 
+OverrideEnableImportAddressFilter: False 
+OverrideEnableRopStackPivot: False 
+OverrideEnableRopCallerCheck: False 
+OverrideEnableRopSimExec: False
 
-Run "MMC".
 
-Select "File", "Add/Remove Snap-in".
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77239" severity="medium" conversionstatus="pass" title="WN10-EP-000200" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Select "Certificates", click "Add".
+This is applicable to unclassified systems, for other systems this is NA.
 
-Select "Computer account", click "Next".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Select "Local computer: (the computer this console is running on)", click "Finish".
+Enter "Get-ProcessMitigation -Name OIS.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Click "OK".
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
+DEP:
+OverrideDEP: False
 
-For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By":
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-Right-click on the certificate and select "Open".
 
-Select the "Details" Tab.
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77243" severity="medium" conversionstatus="pass" title="WN10-EP-000220" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Scroll to the bottom and select "Thumbprint".
+This is applicable to unclassified systems, for other systems this is NA.
 
-If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+Enter "Get-ProcessMitigation -Name OUTLOOK.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Issued To: DoD Root CA 2
-Issued By: DoD Interoperability Root CA 1
-Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
-Valid to: Friday, September 6, 2019
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-Issued To: DoD Root CA 3
-Issued By: DoD Interoperability Root CA 2
-Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
-Valid to: Saturday, January 22, 2022</RawString>
+DEP:
+OverrideDEP: False
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63589" severity="medium" conversionstatus="pass" title="WN10-PK-000020" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77247" severity="medium" conversionstatus="pass" title="WN10-EP-000240" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.
-
-Run "PowerShell" as an administrator.
-
-Execute the following command:
-
-Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding.
+This is applicable to unclassified systems, for other systems this is NA.
 
-If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
-Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
-NotAfter: 9/27/2019
+Enter "Get-ProcessMitigation -Name POWERPNT.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Alternately use the Certificates MMC snap-in:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-Run "MMC".
+DEP:
+OverrideDEP: False
 
-Select "File", "Add/Remove Snap-in".
+ASLR:
+ForceRelocateImages: ON
 
-Select "Certificates", click "Add".
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-Select "Computer account", click "Next".
 
-Select "Local computer: (the computer this console is running on)", click "Finish".
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77249" severity="medium" conversionstatus="pass" title="WN10-EP-000250" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Click "OK".
+This is applicable to unclassified systems, for other systems this is NA.
 
-Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By":
+Enter "Get-ProcessMitigation -Name PPTVIEW.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Right-click on the certificate and select "Open".
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-Select the "Details" tab.
+DEP:
+OverrideDEP: False
 
-Scroll to the bottom and select "Thumbprint".
+ASLR:
+ForceRelocateImages: ON
 
-If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
 
-Issued To: DoD Root CA 3
-Issuer by: US DoD CCEB Interoperability Root CA 2
-Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
-Valid: Friday, September 27, 2019</RawString>
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-63685" severity="medium" conversionstatus="pass" title="WN10-CC-000210" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77255" severity="medium" conversionstatus="pass" title="WN10-EP-000260" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is applicable to unclassified systems, for other systems this is NA.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-If the following registry values do not exist or are not configured as specified, this is a finding:
+This is applicable to unclassified systems, for other systems this is NA.
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Value Name: EnableSmartScreen
+Enter "Get-ProcessMitigation -Name VISIO.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-Value Type: REG_DWORD
-Value: 0x00000001 (1)
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-And
+DEP:
+OverrideDEP: False
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+ASLR:
+ForceRelocateImages: ON
 
-Value Name: ShellSmartScreenLevel
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
 
-Value Type: REG_SZ
-Value: Block
 
-v1607 LTSB:
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77259" severity="medium" conversionstatus="pass" title="WN10-EP-000270" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+This is applicable to unclassified systems, for other systems this is NA.
 
-Value Name: EnableSmartScreen
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Value Type: REG_DWORD
-Value: 0x00000001 (1)
+Enter "Get-ProcessMitigation -Name VPREVIEW.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
-v1507 LTSB:
+If the following mitigations do not have the listed status which is shown below, this is a finding:
 
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+DEP:
+OverrideDEP: False
 
-Value Name: EnableSmartScreen
+ASLR:
+ForceRelocateImages: ON
 
-Value Type: REG_DWORD
-Value: 0x00000002 (2)</RawString>
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-68845" severity="high" conversionstatus="pass" title="WN10-00-000145" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77263" severity="medium" conversionstatus="pass" title="WN10-EP-000280" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the DEP configuration.
-Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
-Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.)
-If the value for "nx" is not "OptOut", this is a finding.
-(The more restrictive configuration of "AlwaysOn" would not be a finding.)</RawString>
+      <RawString>This is NA prior to v1709 of Windows 10.
+
+This is applicable to unclassified systems, for other systems this is NA.
+
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name WINWORD.EXE".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have the listed status which is shown below, this is a finding:
+
+DEP:
+OverrideDEP: False
+
+ASLR:
+ForceRelocateImages: ON
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-72767" severity="medium" conversionstatus="pass" title="WN10-00-000220" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77267" severity="medium" conversionstatus="pass" title="WN10-EP-000290" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA if the system does not have Bluetooth.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.</RawString>
-    </Rule>
-    <Rule id="V-72769" severity="medium" conversionstatus="pass" title="WN10-00-000230" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+This is applicable to unclassified systems, for other systems this is NA.
+
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name wmplayer.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have the listed status which is shown below, this is a finding:
+
+DEP:
+OverrideDEP: False
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+    </Rule>
+    <Rule id="V-77269" severity="medium" conversionstatus="pass" title="WN10-EP-000300" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA if the system does not have Bluetooth.
+      <RawString>This is NA prior to v1709 of Windows 10.
 
-Search for "Bluetooth".
-View Bluetooth Settings.
-Select "More Bluetooth Options"
-If "Alert me when a new Bluetooth device wants to connect" is not checked, this is a finding.</RawString>
+This is applicable to unclassified systems, for other systems this is NA.
+
+Run "Windows PowerShell" with elevated privileges (run as administrator).
+
+Enter "Get-ProcessMitigation -Name wordpad.exe".
+(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+
+If the following mitigations do not have the listed status which is shown below, this is a finding:
+
+DEP:
+OverrideDEP: False
+
+Payload:
+OverrideEnableExportAddressFilter: False
+OverrideEnableExportAddressFilterPlus: False
+OverrideEnableImportAddressFilter: False
+OverrideEnableRopStackPivot: False
+OverrideEnableRopCallerCheck: False
+OverrideEnableRopSimExec: False
+
+
+The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
     </Rule>
-    <Rule id="V-76505" severity="medium" conversionstatus="pass" title="WN10-00-000190" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+  </DocumentRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-63319" severity="medium" conversionstatus="pass" title="WN10-00-000005" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Review the effective User Rights setting in Local Group Policy Editor.
-Run "gpedit.msc".
+      <RawString>Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.
 
-Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
+For standalone systems, this is NA.
 
-Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".)
+Open "Settings".
 
-If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.</RawString>
+Select "System", then "About".
+
+If "Edition" is not "Windows 10 Enterprise", this is a finding.
+
+If "System type" is not "64-bit operating system…", this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77083" severity="medium" conversionstatus="pass" title="WN10-00-000015" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63323" severity="medium" conversionstatus="pass" title="WN10-00-000010" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+      <RawString>Verify domain-joined systems have a TPM enabled and ready for use.
 
-Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS.
+For standalone systems, this is NA.
 
-Run "System Information".
+Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
 
-Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding.</RawString>
+For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+
+Verify the system has a TPM and is ready for use.
+Run "tpm.msc".
+Review the sections in the center pane.
+"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken".
+TPM Manufacturer Information - Specific Version = 2.0 or 1.2
+
+If a TPM is not found or is not ready for use, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77085" severity="low" conversionstatus="pass" title="WN10-00-000020" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63337" severity="medium" conversionstatus="pass" title="WN10-00-000030" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled.
+      <RawString>Verify all Windows 10 information systems (including SIPRNET) employ BitLocker for full disk encryption.
 
-For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
+If full disk encryption using BitLocker is not implemented, this is a finding.
 
-Run "System Information".
+Verify BitLocker is turned on for the operating system drive and any fixed data drives.
 
-Under "System Summary", if "Secure Boot State" does not display "On", this is finding.</RawString>
+Open "BitLocker Drive Encryption" from the Control Panel.
+
+If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding.
+
+NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).</RawString>
     </Rule>
-    <Rule id="V-78129" severity="high" conversionstatus="pass" title="WN10-00-000240" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.
+    <Rule id="V-63345" severity="medium" conversionstatus="pass" title="WN10-00-000035" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.
 
-Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.
+The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is applicable to unclassified systems; for other systems this is NA.
 
-The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
+Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.
 
-Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+If an application whitelisting program is not in use on the system, this is a finding.
+
+Configuration of whitelisting applications will vary by the program.
+
+AppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.
+
+If AppLocker is used, perform the following to view the configuration of AppLocker:
+Run "PowerShell".
+
+Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system:
+Get-AppLockerPolicy -Effective -XML &gt; c:\temp\file.xml
+
+This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.
+
+Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link:
+
+https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm</RawString>
+    </Rule>
+    <Rule id="V-63351" severity="high" conversionstatus="pass" title="WN10-00-000045" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.
+      <RawString>Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.
 
-The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
+If there is no anti-virus solution installed on the system, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-63355" severity="medium" conversionstatus="pass" title="WN10-00-000055" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Allowing other operating systems to run on a secure system may allow security to be circumvented.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Verify the system does not include other operating system installations.
 
-Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet.
+Run "Advanced System Settings".
+Select the "Advanced" tab.
+Click the "Settings" button in the "Startup and Recovery" section.
 
-If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.</RawString>
+If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.</RawString>
     </Rule>
-  </ManualRule>
-  <PermissionRule dscresourcemodule="AccessControlDsc">
-    <Rule id="V-63373.a" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Authenticated Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Authenticated Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>CreateDirectories,AppendData</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63357" severity="medium" conversionstatus="pass" title="WN10-00-000060" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>%SystemDrive%\</Path>
-      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
-If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
-Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
-Viewing in File Explorer:
-Select the "Security" tab, and the "Advanced" button.
-C:\
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-Administrators - Full control - This folder, subfolders and files
-SYSTEM - Full control - This folder, subfolders and files
-Users - Read &amp; execute - This folder, subfolders and files
-Authenticated Users - Modify - Subfolders and files only
-Authenticated Users - Create folders / append data - This folder only
-Alternately use icacls.
-</RawString>
+      <RawString>Non system-created shares should not typically exist on workstations.
+
+If only system-created shares exist on the system this is NA.
+
+Run "Computer Management".
+Navigate to System Tools &gt;&gt; Shared Folders &gt;&gt; Shares.
+
+If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA.
+(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)
+
+Right click any non-system-created shares.
+Select "Properties".
+Select the "Share Permissions" tab.
+
+Verify the necessity of any shares found.
+If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.
+
+Select the "Security" tab.
+
+If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-63373.b" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>TrustedInstaller</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder and subfolders</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63361" severity="high" conversionstatus="pass" title="WN10-00-000070" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.
+
+System administrators must log on to systems only using accounts with the minimum level of authority necessary.
+
+For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.
+
+Standard user accounts must not be members of the local administrators group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>%ProgramFiles%</Path>
-      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
-If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
-Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
-Viewing in File Explorer:
-Select the "Security" tab, and the "Advanced" button.
-\Program Files
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-TrustedInstaller - Full control - This folder and subfolders
-SYSTEM - Modify - This folder only
-SYSTEM - Full control - Subfolders and files only
-Administrators - Modify - This folder only
-Administrators - Full control - Subfolders and files only
-Users - Read &amp; execute - This folder, subfolders and files
-CREATOR OWNER - Full control - Subfolders and files only
-ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-Alternately use icacls.
-</RawString>
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
+Review the members of the Administrators group.
+Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.
+
+For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.
+
+Standard user accounts must not be members of the local administrator group.
+
+If prohibited accounts are members of the local administrators group, this is a finding.
+
+The built-in Administrator account or other required administrative accounts would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-63373.c" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>TrustedInstaller</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder and subfolders</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder only</Inheritance>
-          <Rights>Modify</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>Subfolders and files only</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This folder subfolders and files</Inheritance>
-          <Rights>ReadAndExecute</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63363" severity="medium" conversionstatus="pass" title="WN10-00-000075" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>%Windir%</Path>
-      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
-If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
-Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
-Viewing in File Explorer:
-Select the "Security" tab, and the "Advanced" button.
-\Windows
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-TrustedInstaller - Full control - This folder and subfolders
-SYSTEM - Modify - This folder only
-SYSTEM - Full control - Subfolders and files only
-Administrators - Modify - This folder only
-Administrators - Full control - Subfolders and files only
-Users - Read &amp; execute - This folder, subfolders and files
-CREATOR OWNER - Full control - Subfolders and files only
-ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
-Alternately use icacls.
-</RawString>
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.
+Review the members of the Backup Operators group.
+
+If the group contains no accounts, this is not a finding.
+
+If the group contains any accounts, the accounts must be specifically for backup functions.
+
+If the group contains any standard user accounts used for performing normal user tasks, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-63533" severity="medium" conversionstatus="pass" title="WN10-AU-000515" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Eventlog</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63367" severity="low" conversionstatus="pass" title="WN10-00-000085" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Application.evtx</Path>
-      <RawString>Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
-
-Eventlog - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
 
-The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
+If local users other than the accounts listed below exist on a workstation in a domain, this is a finding.
 
-If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
+Built-in Administrator account (Disabled)
+Built-in Guest account (Disabled)
+Built-in DefaultAccount (Disabled)
+Built-in defaultuser0 (Disabled)
+Built-in WDAGUtilityAccount (Disabled)
+Local administrator account(s)
 
-NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
+All of the built-in accounts may not exist on a system, depending on the Windows 10 version.</RawString>
     </Rule>
-    <Rule id="V-63537" severity="medium" conversionstatus="pass" title="WN10-AU-000520" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Eventlog</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63371" severity="medium" conversionstatus="pass" title="WN10-00-000090" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Security.evtx</Path>
-      <RawString>Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
-
-Eventlog - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
-
-The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
+      <RawString>Run "Computer Management".
+Navigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.
+Double click each active account.
 
-If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
+If "Password never expires" is selected for any account, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-63399" severity="medium" conversionstatus="pass" title="WN10-00-000135" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.
 
-NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
+The configuration requirements will be determined by the applicable firewall STIG.</RawString>
     </Rule>
-    <Rule id="V-63541" severity="medium" conversionstatus="pass" title="WN10-AU-000525" dscresource="NTFSAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Eventlog</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>
-          </Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63403" severity="medium" conversionstatus="pass" title="WN10-00-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>%windir%\SYSTEM32\WINEVT\LOGS\System.evtx</Path>
-      <RawString>Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
+      <RawString>Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.
 
-Eventlog - Full Control
-SYSTEM - Full Control
-Administrators - Full Control
+If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.
 
-The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
+Review inbound firewall exceptions.
+Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Inbound Rules (this link will be in the right pane)
 
-If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
+For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.
 
-NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
+If a third-party firewall is used, ensure comparable settings are in place.</RawString>
     </Rule>
-    <Rule id="V-63593.a" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63583" severity="medium" conversionstatus="pass" title="WN10-PK-000010" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>HKLM:\SECURITY</Path>
-      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
-If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
-Run "Regedit".
-Right click on the registry areas noted below.
-Select "Permissions..." and the "Advanced" button.
-HKEY_LOCAL_MACHINE\SECURITY
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-SYSTEM - Full Control - This key and subkeys
-Administrators - Special - This key and subkeys
-Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
-Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
-S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
-If the defaults have not been changed, these are not a finding.
-</RawString>
+      <RawString>Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.
+
+Run "PowerShell" as an administrator.
+
+Execute the following command:
+
+Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*ECA*" | FL Subject, Thumbprint, NotAfter
+
+If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. 
+
+If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding.
+
+Subject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US
+Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
+NotAfter: 3/30/2028
+
+Subject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US
+Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
+NotAfter: 12/30/2029
+
+Alternately use the Certificates MMC snap-in:
+
+Run "MMC".
+
+Select "File", "Add/Remove Snap-in".
+
+Select "Certificates", click "Add".
+
+Select "Computer account", click "Next".
+
+Select "Local computer: (the computer this console is running on)", click "Finish".
+
+Click "OK".
+
+Expand "Certificates" and navigate to "Trusted Root Certification Authorities &gt;&gt; Certificates".
+
+For each of the ECA Root CA certificates noted below:
+
+Right-click on the certificate and select "Open".
+
+Select the "Details" Tab.
+
+Scroll to the bottom and select "Thumbprint".
+
+If the ECA Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+
+If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+
+ECA Root CA 2
+Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4
+Valid to: Thursday, March 30, 2028
+
+ECA Root CA 4
+Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582
+Valid to: Sunday, December 30, 2029</RawString>
     </Rule>
-    <Rule id="V-63593.b" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-63587" severity="medium" conversionstatus="pass" title="WN10-PK-000015" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <Path>HKLM:\SOFTWARE</Path>
-      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
-If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
-Run "Regedit".
-Right click on the registry areas noted below.
-Select "Permissions..." and the "Advanced" button.
-HKEY_LOCAL_MACHINE\SOFTWARE
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-Users - Read - This key and subkeys
-Administrators - Full Control - This key and subkeys
-SYSTEM - Full Control - This key and subkeys
-CREATOR OWNER - Full Control - This key and subkeys
-ALL APPLICATION PACKAGES - Read - This key and subkeys
-Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
-Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
-S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
-If the defaults have not been changed, these are not a finding.
-</RawString>
-    </Rule>
-    <Rule id="V-63593.c" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
-      <AccessControlEntry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Users</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>Administrators</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>SYSTEM</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>CREATOR OWNER</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>FullControl</Rights>
-        </Entry>
-        <Entry>
-          <Type>
-          </Type>
-          <Principal>ALL APPLICATION PACKAGES</Principal>
-          <ForcePrincipal>False</ForcePrincipal>
-          <Inheritance>This Key and Subkeys</Inheritance>
-          <Rights>ReadKey</Rights>
-        </Entry>
-      </AccessControlEntry>
-      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Force>True</Force>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <Path>HKLM:\SYSTEM</Path>
-      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
-If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
-Run "Regedit".
-Right click on the registry areas noted below.
-Select "Permissions..." and the "Advanced" button.
-HKEY_LOCAL_MACHINE\SYSTEM
-Type - "Allow" for all
-Inherited from - "None" for all
-Principal - Access - Applies to
-Users - Read - This key and subkeys
-Administrators - Full Control - This key and subkeys
-SYSTEM - Full Control - This key and subkeys
-CREATOR OWNER - Full Control - This key and subkeys
-ALL APPLICATION PACKAGES - Read - This key and subkeys
-Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
-Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
-S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
-If the defaults have not been changed, these are not a finding.
-</RawString>
-    </Rule>
-  </PermissionRule>
-  <ProcessMitigationRule dscresourcemodule="WindowsDefenderDsc">
-    <Rule id="V-77091" severity="medium" conversionstatus="pass" title="WN10-EP-000020" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.
 
-This is applicable to unclassified systems, for other systems this is NA.
+Run "PowerShell" as an administrator.
 
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
+Execute the following command:
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter
 
-Enter "Get-ProcessMitigation -System".
+If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. 
 
-If the status of "DEP: Enable" is "OFF", this is a finding.
+If an expired certificate ("NotAfter" date) is found, this is a finding.
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
-    </Rule>
-    <Rule id="V-77095" severity="medium" conversionstatus="pass" title="WN10-EP-000030" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>BottomUp</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
+NotAfter: 9/6/2019
 
-This is applicable to unclassified systems, for other systems this is NA.
+Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
+NotAfter: 1/22/2022
 
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
+Alternately use the Certificates MMC snap-in:
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Run "MMC".
 
-Enter "Get-ProcessMitigation -System".
+Select "File", "Add/Remove Snap-in".
 
-If the status of "ASLR: BottomUp" is "OFF", this is a finding.
+Select "Certificates", click "Add".
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
-    </Rule>
-    <Rule id="V-77097" severity="medium" conversionstatus="pass" title="WN10-EP-000040" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>CFG</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Select "Computer account", click "Next".
 
-This is applicable to unclassified systems, for other systems this is NA.
+Select "Local computer: (the computer this console is running on)", click "Finish".
 
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
+Click "OK".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
 
-Enter "Get-ProcessMitigation -System".
+For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By":
 
-If the status of "CFG: Enable" is "OFF", this is a finding.
+Right-click on the certificate and select "Open".
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
+Select the "Details" Tab.
+
+Scroll to the bottom and select "Thumbprint".
+
+If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
+
+If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+
+Issued To: DoD Root CA 2
+Issued By: DoD Interoperability Root CA 1
+Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F
+Valid to: Friday, September 6, 2019
+
+Issued To: DoD Root CA 3
+Issued By: DoD Interoperability Root CA 2
+Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341
+Valid to: Saturday, January 22, 2022</RawString>
     </Rule>
-    <Rule id="V-77101" severity="medium" conversionstatus="pass" title="WN10-EP-000050" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63589" severity="medium" conversionstatus="pass" title="WN10-PK-000020" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>SEHOP</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.
 
-This is applicable to unclassified systems, for other systems this is NA.
+Run "PowerShell" as an administrator.
 
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
+Execute the following command:
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter
 
-Enter "Get-ProcessMitigation -System".
+If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. 
 
-If the status of "SEHOP: Enable" is "OFF", this is a finding.
+If an expired certificate ("NotAfter" date) is found, this is a finding.
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
-    </Rule>
-    <Rule id="V-77103" severity="medium" conversionstatus="pass" title="WN10-EP-000060" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>TerminateOnError</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>System</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
+Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
+NotAfter: 9/27/2019
 
-This is applicable to unclassified systems, for other systems this is NA.
+Alternately use the Certificates MMC snap-in:
 
-The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
+Run "MMC".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Select "File", "Add/Remove Snap-in".
 
-Enter "Get-ProcessMitigation -System".
+Select "Certificates", click "Add".
 
-If the status of "Heap: TerminateOnError" is "OFF", this is a finding.
+Select "Computer account", click "Next".
 
-Values that would not be a finding include:
-ON
-NOTSET (Default configuration)</RawString>
-    </Rule>
-    <Rule id="V-77189" severity="medium" conversionstatus="pass" title="WN10-EP-000070" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>Acrobat.exe</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Select "Local computer: (the computer this console is running on)", click "Finish".
 
-This is applicable to unclassified systems, for other systems this is NA.
+Click "OK".
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Expand "Certificates" and navigate to "Untrusted Certificates &gt;&gt; Certificates".
 
-Enter "Get-ProcessMitigation -Name Acrobat.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By":
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Right-click on the certificate and select "Open".
 
-DEP:
-Enable: ON
+Select the "Details" tab.
 
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+Scroll to the bottom and select "Thumbprint".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding.
+
+Issued To: DoD Root CA 3
+Issuer by: US DoD CCEB Interoperability Root CA 2
+Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E
+Valid: Friday, September 27, 2019</RawString>
     </Rule>
-    <Rule id="V-77191" severity="medium" conversionstatus="pass" title="WN10-EP-000080" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63685" severity="medium" conversionstatus="pass" title="WN10-CC-000210" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>AcroRd32.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>This is applicable to unclassified systems, for other systems this is NA.
 
-This is applicable to unclassified systems, for other systems this is NA.
+If the following registry values do not exist or are not configured as specified, this is a finding:
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
 
-Enter "Get-ProcessMitigation -Name AcroRd32.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Value Name: EnableSmartScreen
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Value Type: REG_DWORD
+Value: 0x00000001 (1)
 
-DEP:
-Enable: ON
+And
 
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Value Name: ShellSmartScreenLevel
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77195" severity="medium" conversionstatus="pass" title="WN10-EP-000090" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>chrome.exe</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+Value Type: REG_SZ
+Value: Block
 
-This is applicable to unclassified systems, for other systems this is NA.
+v1607 LTSB:
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
 
-Enter "Get-ProcessMitigation -Name chrome.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+Value Name: EnableSmartScreen
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Value Type: REG_DWORD
+Value: 0x00000001 (1)
 
-DEP:
-Enable: ON
+v1507 LTSB:
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\
+
+Value Name: EnableSmartScreen
+
+Value Type: REG_DWORD
+Value: 0x00000002 (2)</RawString>
     </Rule>
-    <Rule id="V-77201" severity="medium" conversionstatus="pass" title="WN10-EP-000100" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-68845" severity="high" conversionstatus="pass" title="WN10-00-000145" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>EXCEL.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name EXCEL.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <RawString>Verify the DEP configuration.
+Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
+Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.)
+If the value for "nx" is not "OptOut", this is a finding.
+(The more restrictive configuration of "AlwaysOn" would not be a finding.)</RawString>
     </Rule>
-    <Rule id="V-77205" severity="medium" conversionstatus="pass" title="WN10-EP-000110" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-72767" severity="medium" conversionstatus="pass" title="WN10-00-000220" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>firefox.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name firefox.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+      <RawString>This is NA if the system does not have Bluetooth.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77209" severity="medium" conversionstatus="pass" title="WN10-EP-000120" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-72769" severity="medium" conversionstatus="pass" title="WN10-00-000230" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>FLTLDR.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name FLTLDR.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ImageLoad:
-BlockRemoteImageLoads: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+      <RawString>This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy.
 
-Child Process:
-DisallowChildProcessCreation: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Search for "Bluetooth".
+View Bluetooth Settings.
+Select "More Bluetooth Options"
+If "Alert me when a new Bluetooth device wants to connect" is not checked, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-77213" severity="medium" conversionstatus="pass" title="WN10-EP-000130" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-76505" severity="medium" conversionstatus="pass" title="WN10-00-000190" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>GROOVE.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name GROOVE.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+      <RawString>Review the effective User Rights setting in Local Group Policy Editor.
+Run "gpedit.msc".
 
-DEP:
-Enable: ON
+Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
 
-ASLR:
-ForceRelocateImages: ON
+Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".)
 
-ImageLoad:
-BlockRemoteImageLoads: ON
+If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-77083" severity="medium" conversionstatus="pass" title="WN10-00-000015" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS.
 
-Child Process:
-DisallowChildProcessCreation: ON
+Run "System Information".
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding.</RawString>
     </Rule>
-    <Rule id="V-77217" severity="medium" conversionstatus="pass" title="WN10-EP-000140" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-77085" severity="low" conversionstatus="pass" title="WN10-00-000020" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>iexplore.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. 
 
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name iexplore.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Run "System Information".
 
-DEP:
-Enable: ON
+Under "System Summary", if "Secure Boot State" does not display "On", this is finding.</RawString>
+    </Rule>
+    <Rule id="V-78129" severity="high" conversionstatus="pass" title="WN10-00-000240" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.
 
-ASLR:
-BottomUp: ON
-ForceRelocateImages: ON
+Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77221" severity="medium" conversionstatus="pass" title="WN10-EP-000150" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>INFOPATH.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
+      <RawString>Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.
 
-This is applicable to unclassified systems, for other systems this is NA.
+The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
+Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. 
 
-Enter "Get-ProcessMitigation -Name INFOPATH.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-99555" severity="medium" conversionstatus="pass" title="WN10-SO-000280" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure.
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Review the password last set date for the enabled local Administrator account.
 
-DEP:
-Enable: ON
+On the local domain joined workstation:
 
-ASLR:
-ForceRelocateImages: ON
+Open "PowerShell".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+Enter "Get-LocalUser –Name * | Select-Object *”
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77223.a" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>java.exe</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
-java.exe, javaw.exe, and javaws.exe
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON" for each, this is a finding:
-
-DEP:
-Enable: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
-    </Rule>
-    <Rule id="V-77223.b" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
-      <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>javaw.exe</MitigationTarget>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
-java.exe, javaw.exe, and javaws.exe
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON" for each, this is a finding:
-
-DEP:
-Enable: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+If the "PasswordLastSet" date is greater than "60" days old for the local Administrator account for administering the computer/domain, this is a finding.
+</RawString>
     </Rule>
-    <Rule id="V-77223.c" severity="medium" conversionstatus="pass" title="WN10-EP-000160" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+  </ManualRule>
+  <PermissionRule dscresourcemodule="AccessControlDsc">
+    <Rule id="V-63373.a" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Authenticated Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Authenticated Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>CreateDirectories,AppendData</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>javaws.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]:
-java.exe, javaw.exe, and javaws.exe
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON" for each, this is a finding:
-
-DEP:
-Enable: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>%SystemDrive%\</Path>
+      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
+If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
+Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
+Viewing in File Explorer:
+Select the "Security" tab, and the "Advanced" button.
+C:\
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+Administrators - Full control - This folder, subfolders and files
+SYSTEM - Full control - This folder, subfolders and files
+Users - Read &amp; execute - This folder, subfolders and files
+Authenticated Users - Modify - Subfolders and files only
+Authenticated Users - Create folders / append data - This folder only
+Alternately use icacls.
+</RawString>
     </Rule>
-    <Rule id="V-77227" severity="medium" conversionstatus="pass" title="WN10-EP-000170" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63373.b" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>TrustedInstaller</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder and subfolders</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>lync.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name lync.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>%ProgramFiles%</Path>
+      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
+If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
+Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
+Viewing in File Explorer:
+Select the "Security" tab, and the "Advanced" button.
+\Program Files
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+TrustedInstaller - Full control - This folder and subfolders
+SYSTEM - Modify - This folder only
+SYSTEM - Full control - Subfolders and files only
+Administrators - Modify - This folder only
+Administrators - Full control - Subfolders and files only
+Users - Read &amp; execute - This folder, subfolders and files
+CREATOR OWNER - Full control - Subfolders and files only
+ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+Alternately use icacls.
+</RawString>
     </Rule>
-    <Rule id="V-77231" severity="medium" conversionstatus="pass" title="WN10-EP-000180" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63373.c" severity="medium" conversionstatus="pass" title="WN10-00-000095" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>TrustedInstaller</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder and subfolders</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder only</Inheritance>
+          <Rights>Modify</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>Subfolders and files only</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL RESTRICTED APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This folder subfolders and files</Inheritance>
+          <Rights>ReadAndExecute</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>MSACCESS.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name MSACCESS.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>%Windir%</Path>
+      <RawString>The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).
+If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.
+Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)
+Viewing in File Explorer:
+Select the "Security" tab, and the "Advanced" button.
+\Windows
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+TrustedInstaller - Full control - This folder and subfolders
+SYSTEM - Modify - This folder only
+SYSTEM - Full control - Subfolders and files only
+Administrators - Modify - This folder only
+Administrators - Full control - Subfolders and files only
+Users - Read &amp; execute - This folder, subfolders and files
+CREATOR OWNER - Full control - Subfolders and files only
+ALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+ALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files
+Alternately use icacls.
+</RawString>
     </Rule>
-    <Rule id="V-77233" severity="medium" conversionstatus="pass" title="WN10-EP-000190" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63533" severity="medium" conversionstatus="pass" title="WN10-AU-000515" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Eventlog</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>MSPUB.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name MSPUB.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Application.evtx</Path>
+      <RawString>Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
 
-DEP:
-Enable: ON
+Eventlog - Full Control
+SYSTEM - Full Control
+Administrators - Full Control
 
-ASLR:
-ForceRelocateImages: ON
+The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-77235" severity="medium" conversionstatus="pass" title="WN10-EP-000210" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63537" severity="medium" conversionstatus="pass" title="WN10-AU-000520" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Eventlog</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>OneDrive.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name OneDrive.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
+      <Path>%windir%\SYSTEM32\WINEVT\LOGS\Security.evtx</Path>
+      <RawString>Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
 
-ASLR:
-ForceRelocateImages: ON
+Eventlog - Full Control
+SYSTEM - Full Control
+Administrators - Full Control
 
-ImageLoad:
-BlockRemoteImageLoads: ON
+The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-77239" severity="medium" conversionstatus="pass" title="WN10-EP-000200" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63541" severity="medium" conversionstatus="pass" title="WN10-AU-000525" dscresource="NTFSAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Eventlog</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>
+          </Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>OIS.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name OIS.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+      <Path>%windir%\SYSTEM32\WINEVT\LOGS\System.evtx</Path>
+      <RawString>Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Eventlog - Full Control
+SYSTEM - Full Control
+Administrators - Full Control
 
-DEP:
-Enable: ON
+The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.</RawString>
     </Rule>
-    <Rule id="V-77243" severity="medium" conversionstatus="pass" title="WN10-EP-000220" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63593.a" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>OUTLOOK.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name OUTLOOK.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>HKLM:\SECURITY</Path>
+      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
+If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
+Run "Regedit".
+Right click on the registry areas noted below.
+Select "Permissions..." and the "Advanced" button.
+HKEY_LOCAL_MACHINE\SECURITY
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+SYSTEM - Full Control - This key and subkeys
+Administrators - Special - This key and subkeys
+Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
+Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
+S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
+If the defaults have not been changed, these are not a finding.
+</RawString>
     </Rule>
-    <Rule id="V-77245" severity="medium" conversionstatus="pass" title="WN10-EP-000230" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63593.b" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>plugin-container.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name plugin-container.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>HKLM:\SOFTWARE</Path>
+      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
+If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
+Run "Regedit".
+Right click on the registry areas noted below.
+Select "Permissions..." and the "Advanced" button.
+HKEY_LOCAL_MACHINE\SOFTWARE
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+Users - Read - This key and subkeys
+Administrators - Full Control - This key and subkeys
+SYSTEM - Full Control - This key and subkeys
+CREATOR OWNER - Full Control - This key and subkeys
+ALL APPLICATION PACKAGES - Read - This key and subkeys
+Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
+Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
+S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
+If the defaults have not been changed, these are not a finding.
+</RawString>
     </Rule>
-    <Rule id="V-77247" severity="medium" conversionstatus="pass" title="WN10-EP-000240" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <Disable />
+    <Rule id="V-63593.c" severity="medium" conversionstatus="pass" title="WN10-RG-000005" dscresource="RegistryAccessEntry">
+      <AccessControlEntry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Users</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>Administrators</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>SYSTEM</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>CREATOR OWNER</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>FullControl</Rights>
+        </Entry>
+        <Entry>
+          <Type>
+          </Type>
+          <Principal>ALL APPLICATION PACKAGES</Principal>
+          <ForcePrincipal>False</ForcePrincipal>
+          <Inheritance>This Key and Subkeys</Inheritance>
+          <Rights>ReadKey</Rights>
+        </Entry>
+      </AccessControlEntry>
+      <Description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Force>True</Force>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>POWERPNT.EXE</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is NA prior to v1709 of Windows 10.
-
-This is applicable to unclassified systems, for other systems this is NA.
-
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name POWERPNT.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
-
-DEP:
-Enable: ON
-
-ASLR:
-ForceRelocateImages: ON
-
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
-
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+      <Path>HKLM:\SYSTEM</Path>
+      <RawString>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.
+If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.
+Run "Regedit".
+Right click on the registry areas noted below.
+Select "Permissions..." and the "Advanced" button.
+HKEY_LOCAL_MACHINE\SYSTEM
+Type - "Allow" for all
+Inherited from - "None" for all
+Principal - Access - Applies to
+Users - Read - This key and subkeys
+Administrators - Full Control - This key and subkeys
+SYSTEM - Full Control - This key and subkeys
+CREATOR OWNER - Full Control - This key and subkeys
+ALL APPLICATION PACKAGES - Read - This key and subkeys
+Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.
+Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.
+S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
+If the defaults have not been changed, these are not a finding.
+</RawString>
     </Rule>
-    <Rule id="V-77249" severity="medium" conversionstatus="pass" title="WN10-EP-000250" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+  </PermissionRule>
+  <ProcessMitigationRule dscresourcemodule="WindowsDefenderDsc">
+    <Rule id="V-77091" severity="medium" conversionstatus="pass" title="WN10-EP-000020" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>DEP</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>PPTVIEW.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name PPTVIEW.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "DEP: Enable" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77255" severity="medium" conversionstatus="pass" title="WN10-EP-000260" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77095" severity="medium" conversionstatus="pass" title="WN10-EP-000030" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>BottomUp</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>VISIO.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name VISIO.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "ASLR: BottomUp" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77259" severity="medium" conversionstatus="pass" title="WN10-EP-000270" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77097" severity="medium" conversionstatus="pass" title="WN10-EP-000040" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>CFG</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>VPREVIEW.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name VPREVIEW.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "CFG: Enable" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77263" severity="medium" conversionstatus="pass" title="WN10-EP-000280" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77101" severity="medium" conversionstatus="pass" title="WN10-EP-000050" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>SEHOP</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>WINWORD.EXE</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name WINWORD.EXE".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
-
-If the following mitigations do not have a status of "ON", this is a finding:
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-DEP:
-Enable: ON
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-ASLR:
-ForceRelocateImages: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableExportAddressFilter: ON
-EnableExportAddressFilterPlus: ON
-EnableImportAddressFilter: ON
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "SEHOP: Enable" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77267" severity="medium" conversionstatus="pass" title="WN10-EP-000290" dscresource="ProcessMitigation">
-      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+    <Rule id="V-77103" severity="medium" conversionstatus="pass" title="WN10-EP-000060" dscresource="ProcessMitigation">
+      <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
-      <Enable>DEP,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
+      <Enable>TerminateOnError</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>wmplayer.exe</MitigationTarget>
+      <MitigationTarget>System</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
 
 This is applicable to unclassified systems, for other systems this is NA.
 
-Run "Windows PowerShell" with elevated privileges (run as administrator).
-
-Enter "Get-ProcessMitigation -Name wmplayer.exe".
-(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
+The default configuration in Exploit Protection is "On by default" which meets this requirement.  The PowerShell query results for this show as "NOTSET".
 
-If the following mitigations do not have a status of "ON", this is a finding:
+Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-DEP:
-Enable: ON
+Enter "Get-ProcessMitigation -System".
 
-Payload:
-EnableRopStackPivot: ON
-EnableRopCallerCheck: ON
-EnableRopSimExec: ON
+If the status of "Heap: TerminateOnError" is "OFF", this is a finding.
 
-The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</RawString>
+Values that would not be a finding include:
+ON
+NOTSET (Default configuration)</RawString>
     </Rule>
-    <Rule id="V-77269" severity="medium" conversionstatus="pass" title="WN10-EP-000300" dscresource="ProcessMitigation">
+    <Rule id="V-77245" severity="medium" conversionstatus="pass" title="WN10-EP-000230" dscresource="ProcessMitigation">
       <Description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <Disable />
       <DuplicateOf />
       <Enable>DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec</Enable>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <MitigationTarget>wordpad.exe</MitigationTarget>
+      <MitigationTarget>plugin-container.exe</MitigationTarget>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>This is NA prior to v1709 of Windows 10.
@@ -3320,7 +3296,7 @@ This is applicable to unclassified systems, for other systems this is NA.
 
 Run "Windows PowerShell" with elevated privileges (run as administrator).
 
-Enter "Get-ProcessMitigation -Name wordpad.exe".
+Enter "Get-ProcessMitigation -Name plugin-container.exe".
 (Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)
 
 If the following mitigations do not have a status of "ON", this is a finding:
@@ -3472,7 +3448,7 @@ Value: 0</RawString>
       <ValueName>AllowUnencryptedTraffic</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
-    <Rule id="V-63341" severity="medium" conversionstatus="pass" title="WN10-CC-000340" dscresource="RegistryPolicyFile">
+    <Rule id="V-63341" severity="medium" conversionstatus="pass" title="WN10-CC-000360" dscresource="RegistryPolicyFile">
       <Description>&lt;VulnDiscussion&gt;Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <Ensure>Present</Ensure>
@@ -3940,7 +3916,7 @@ Value: 0x00000000 (0)</RawString>
       <ValueName>LocalAccountTokenFilterPolicy</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
-    <Rule id="V-63599" severity="low" conversionstatus="pass" title="WN10-CC-000075" dscresource="RegistryPolicyFile">
+    <Rule id="V-63599" severity="high" conversionstatus="pass" title="WN10-CC-000075" dscresource="RegistryPolicyFile">
       <Description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <Ensure>Present</Ensure>
@@ -3950,9 +3926,7 @@ Value: 0x00000000 (0)</RawString>
       <OrganizationValueTestString />
       <RawString>Confirm Credential Guard is running on domain-joined systems.
 
-For standalone systems, this is NA.
-
-For those devices that support Credential Guard, this feature must be enabled. For devices that do not support it, there is currently an enterprise risk acceptance in effect, thus this check is currently categorized as a CAT III. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.
+For those devices that support Credential Guard, this feature must be enabled. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.
 
 Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.
 
@@ -3979,22 +3953,22 @@ Value Name: LsaCfgFlags
 Value Type: REG_DWORD
 Value: 0x00000001 (1) (Enabled with UEFI lock)
 
-NOTE:  The severity level for the requirement will be upgraded to CAT I starting January 2020.</RawString>
+</RawString>
       <ValueData>1</ValueData>
       <ValueName>LsaCfgFlags</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
     <Rule id="V-63607" severity="medium" conversionstatus="pass" title="WN10-CC-000085" dscresource="RegistryPolicyFile">
-      <Description>&lt;VulnDiscussion&gt;Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization.  The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application.  At a minimum, drivers determined to be bad must not be allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <Description>&lt;VulnDiscussion&gt;By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <Ensure>Present</Ensure>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch</Key>
       <OrganizationValueRequired>True</OrganizationValueRequired>
-      <OrganizationValueTestString>'{0}' -match '1|3|8|ShouldBeAbsent'</OrganizationValueTestString>
+      <OrganizationValueTestString>'{0}' -match '1|3|8'</OrganizationValueTestString>
       <RawString>The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad").
 
-If the registry value name below does not exist, this is not a finding.
+If the registry value name below does not exist, this a finding.
 
 If it exists and is configured with a value of "7", this is a finding.
 
@@ -4004,13 +3978,14 @@ Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\
 Value Name: DriverLoadPolicy
 
 Value Type: REG_DWORD
-Value: 1, 3, or 8 (or if the Value Name does not exist)
+Value: 1, 3, or 8 
 
 Possible values for this setting are:
 8 - Good only
 1 - Good and unknown
 3 - Good, unknown and bad but critical
-7 - All (which includes "Bad" and would be a finding)</RawString>
+7 - All (which includes "Bad" and would be a finding)
+</RawString>
       <ValueData />
       <ValueName>DriverLoadPolicy</ValueName>
       <ValueType>Dword</ValueType>
@@ -4332,7 +4307,7 @@ Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\
 
 Value Name: fAllowToGetHelp
-
+ 
 Value Type: REG_DWORD
 Value: 0</RawString>
       <ValueData>0</ValueData>
@@ -4465,7 +4440,7 @@ Value Name: RequireStrongKey
 
 Value Type: REG_DWORD
 Value: 1
-
+ 
 Warning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.</RawString>
       <ValueData>1</ValueData>
       <ValueName>RequireStrongKey</ValueName>
@@ -4573,7 +4548,7 @@ Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
 Value Name: LegalNoticeText
 
 Value Type: REG_SZ
-Value:
+Value: 
 You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
 
 By using this IS (which includes any device attached to this IS), you consent to the following conditions:
@@ -4708,7 +4683,7 @@ If an organization is using v1709 or later of Windows 10 this may be configured
 
 If the following registry value does not exist or is not configured as specified, this is a finding:
 
-Registry Hive:  HKEY_LOCAL_MACHINE
+Registry Hive:  HKEY_LOCAL_MACHINE 
 Registry Path:  \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
 
 Value Name:  CachedLogonsCount
@@ -4899,50 +4874,6 @@ Value: 1</RawString>
       <ValueName>RequireSecuritySignature</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
-    <Rule id="V-63705" severity="medium" conversionstatus="pass" title="WN10-CC-000240" dscresource="RegistryPolicyFile">
-      <Description>&lt;VulnDiscussion&gt;The InPrivate browsing feature in Microsoft Edge prevents the storing of history, cookies, temporary Internet files, or other data.  Disabling this feature maintains this data for review as necessary.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.
-
-If the following registry value does not exist or is not configured as specified, this is a finding.
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main\
-
-Value Name: AllowInPrivate
-
-Type: REG_DWORD
-Value: 0x00000000 (0)</RawString>
-      <ValueData>0</ValueData>
-      <ValueName>AllowInPrivate</ValueName>
-      <ValueType>Dword</ValueType>
-    </Rule>
-    <Rule id="V-63707" severity="medium" conversionstatus="pass" title="WN10-SO-000105" dscresource="Registry">
-      <Description>&lt;VulnDiscussion&gt;The server message block (SMB) protocol provides the basis for many network operations.   If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding:
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\
-
-Value Name: EnableSecuritySignature
-
-Value Type: REG_DWORD
-Value: 1</RawString>
-      <ValueData>1</ValueData>
-      <ValueName>EnableSecuritySignature</ValueName>
-      <ValueType>Dword</ValueType>
-    </Rule>
     <Rule id="V-63709" severity="medium" conversionstatus="pass" title="WN10-CC-000245" dscresource="RegistryPolicyFile">
       <Description>&lt;VulnDiscussion&gt;Passwords save locally for re-use when browsing may be subject to compromise.  Disabling the Edge password manager will prevent this for the browser.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
@@ -5077,27 +5008,6 @@ Value:  6 (or greater)</RawString>
       <ValueName>MinimumPINLength</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
-    <Rule id="V-63723" severity="medium" conversionstatus="pass" title="WN10-SO-000125" dscresource="Registry">
-      <Description>&lt;VulnDiscussion&gt;The server message block (SMB) protocol provides the basis for many network operations.   Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding:
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\
-
-Value Name: EnableSecuritySignature
-
-Value Type: REG_DWORD
-Value: 1</RawString>
-      <ValueData>1</ValueData>
-      <ValueName>EnableSecuritySignature</ValueName>
-      <ValueType>Dword</ValueType>
-    </Rule>
     <Rule id="V-63729" severity="medium" conversionstatus="pass" title="WN10-CC-000270" dscresource="RegistryPolicyFile">
       <Description>&lt;VulnDiscussion&gt;Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system.  The system must be configured to prevent users from saving passwords in the Remote Desktop Client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
@@ -5356,27 +5266,6 @@ Value: 1</RawString>
       <ValueName>RestrictNullSessAccess</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
-    <Rule id="V-63763" severity="medium" conversionstatus="pass" title="WN10-SO-000175" dscresource="Registry">
-      <Description>&lt;VulnDiscussion&gt;Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously vs. using the computer identity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding:
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\
-
-Value Name: UseMachineId
-
-Value Type: REG_DWORD
-Value: 1</RawString>
-      <ValueData>1</ValueData>
-      <ValueName>UseMachineId</ValueName>
-      <ValueType>Dword</ValueType>
-    </Rule>
     <Rule id="V-63765" severity="medium" conversionstatus="pass" title="WN10-SO-000180" dscresource="Registry">
       <Description>&lt;VulnDiscussion&gt;NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
@@ -5562,7 +5451,7 @@ Value Name: Enabled
 
 Value Type: REG_DWORD
 Value: 1
-
+ 
 Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms.  Both the browser and web server must be configured to use TLS otherwise the browser will not be able to connect to a secure site.</RawString>
       <ValueData>1</ValueData>
       <ValueName>Enabled</ValueName>
@@ -5830,7 +5719,7 @@ Enabling "Include command line data for process creation events" will record the
       <OrganizationValueTestString />
       <RawString>If the following registry value does not exist or is not configured as specified, this is a finding.
 
-Registry Hive: HKEY_LOCAL_MACHINE
+Registry Hive: HKEY_LOCAL_MACHINE 
 Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\
 
 Value Name: ProcessCreationIncludeCmdLine_Enabled
@@ -5853,7 +5742,7 @@ Enabling PowerShell script block logging will record detailed information from t
       <OrganizationValueTestString />
       <RawString>If the following registry value does not exist or is not configured as specified, this is a finding.
 
-Registry Hive: HKEY_LOCAL_MACHINE
+Registry Hive: HKEY_LOCAL_MACHINE 
 Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\
 
 Value Name: EnableScriptBlockLogging
@@ -6066,29 +5955,6 @@ Value: NistP384 NistP256</RawString>
       <ValueName>EccCurves</ValueName>
       <ValueType>MultiString</ValueType>
     </Rule>
-    <Rule id="V-74415" severity="medium" conversionstatus="pass" title="WN10-CC-000228" dscresource="RegistryPolicyFile">
-      <Description>&lt;VulnDiscussion&gt;Clearing browser data on exit automatically deletes specified items when the last browser window closes.  This data could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures.  Disabling this function will prevent the data from automatically being deleted when the browser closes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DuplicateOf />
-      <Ensure>Present</Ensure>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Privacy</Key>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems.
-
-If the following registry value does not exist or is not configured as specified, this is a finding.
-
-Registry Hive: HKEY_LOCAL_MACHINE
-Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\ Privacy\
-
-Value Name: ClearBrowsingHistoryOnExit
-
-Type: REG_DWORD
-Value: 0x00000000 (0)</RawString>
-      <ValueData>0</ValueData>
-      <ValueName>ClearBrowsingHistoryOnExit</ValueName>
-      <ValueType>Dword</ValueType>
-    </Rule>
     <Rule id="V-74417" severity="medium" conversionstatus="pass" title="WN10-CC-000252" dscresource="RegistryPolicyFile">
       <Description>&lt;VulnDiscussion&gt;Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
@@ -6356,11 +6222,14 @@ Value: 0x00000001 (1)</RawString>
       <DuplicateOf />
       <Ensure>Present</Ensure>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\</Key>
+      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE</Key>
       <OrganizationValueRequired>True</OrganizationValueRequired>
       <OrganizationValueTestString>ValueData is set to 0x00000006 (6) or greater </OrganizationValueTestString>
       <RawString>If the following registry value does not exist or is not configured as specified, this is a finding.
 
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \SOFTWARE\Policies\Microsoft\FVE\
+
 Value Name: MinimumPIN
 Type: REG_DWORD
 Value: 0x00000006 (6) or greater</RawString>
@@ -6368,6 +6237,132 @@ Value: 0x00000006 (6) or greater</RawString>
       <ValueName>MinimumPIN</ValueName>
       <ValueType>DWord</ValueType>
     </Rule>
+    <Rule id="V-99557" severity="medium" conversionstatus="pass" title="WN10-EP-000310" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Kernel DMA Protection</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>This is NA prior to v1803 of Windows 10.
+
+If the following registry value does not exist or is not configured as specified, this is a finding.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \Software\Policies\Microsoft\Windows\Kernel DMA Protection
+
+Value Name: DeviceEnumerationPolicy
+Value Type: REG_DWORD
+Value: 0</RawString>
+      <ValueData>0</ValueData>
+      <ValueName>DeviceEnumerationPolicy</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-99559" severity="medium" conversionstatus="pass" title="WN10-CC-000370" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \Software\Policies\Microsoft\Windows\System
+
+Value Name: AllowDomainPINLogon
+Value Type: REG_DWORD
+Value data: 0</RawString>
+      <ValueData>0</ValueData>
+      <ValueName>AllowDomainPINLogon</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-99561" severity="medium" conversionstatus="pass" title="WN10-CC-000385" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Securing Windows Ink which contains application and features oriented towards pen computing. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsInkWorkspace</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding.
+
+Registry Hive: HKEY_LOCAL_MACHINE
+Registry Path: \Software\Policies\Microsoft\WindowsInkWorkspace
+
+Value Name: AllowWindowsInkWorkspace
+Value Type: REG_DWORD
+Value data: 1
+
+</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>AllowWindowsInkWorkspace</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-99563" severity="low" conversionstatus="pass" title="WN10-CC-000390" dscresource="RegistryPolicyFile">
+      <Description>&lt;VulnDiscussion&gt;Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CloudContent</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If the following registry value does not exist or is not configured as specified, this is a finding.
+
+If the following registry value does not exist or is not configured as specified, this is a finding: 
+
+Registry Hive: HKEY_CURRENT_USER
+Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CloudContent\
+
+Value Name: DisableThirdPartySuggestions
+
+Type: REG_DWORD
+Value: 0x00000001 (1)
+
+</RawString>
+      <ValueData>1</ValueData>
+      <ValueName>DisableThirdPartySuggestions</ValueName>
+      <ValueType>Dword</ValueType>
+    </Rule>
+    <Rule id="V-100093" severity="medium" conversionstatus="pass" title="SRG-OS-000095-GPOS-00049" dscresource="Registry">
+      <Description>&lt;VulnDiscussion&gt;It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.
+
+Failing to disconnect from collaborative computing devices (i.e. cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures.
+
+Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Ensure>Present</Ensure>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If the device or operating system does not have a camera installed, this requirement is not applicable.
+
+This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.
+
+This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.
+
+For an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding.
+
+For a built-in camera, the camera must be protected by a camera cover (e.g. laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or if the built-in
+camera is not disabled in the bios, this is a finding.
+
+If the camera is not disconnected or covered, the following registry entry is required:
+
+Registry Hive: HKEY_LOCAL_MACHINE
+RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam
+
+Value Name: Deny
+
+If "Value Name" is set to a value other than "Deny" and the collaborative computing device has not been authorized for use, this is a finding.
+</RawString>
+      <ValueData>Deny</ValueData>
+      <ValueName>Value</ValueName>
+      <ValueType>String</ValueType>
+    </Rule>
   </RegistryRule>
   <SecurityOptionRule dscresourcemodule="SecurityPolicyDsc">
     <Rule id="V-63601" severity="medium" conversionstatus="pass" title="WN10-SO-000005" dscresource="SecurityOption">
@@ -6934,28 +6929,6 @@ Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windo
 If any groups or accounts other than the following are granted the "Force shutdown from a remote system" user right, this is a finding:
 
 Administrators</RawString>
-    </Rule>
-    <Rule id="V-63887" severity="medium" conversionstatus="pass" title="WN10-UR-000105" dscresource="UserRightsAssignment">
-      <Constant>SeAuditPrivilege</Constant>
-      <Description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
-
-The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DisplayName>Generate security audits</DisplayName>
-      <DuplicateOf />
-      <Force>True</Force>
-      <Identity>LOCAL SERVICE,NETWORK SERVICE</Identity>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Verify the effective setting in Local Group Policy Editor.
-Run "gpedit.msc".
-
-Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
-
-If any groups or accounts other than the following are granted the "Generate security audits" user right, this is a finding:
-
-LOCAL SERVICE
-NETWORK SERVICE</RawString>
     </Rule>
     <Rule id="V-63889" severity="medium" conversionstatus="pass" title="WN10-UR-000110" dscresource="UserRightsAssignment">
       <Constant>SeImpersonatePrivilege</Constant>
@@ -6980,28 +6953,6 @@ Administrators
 LOCAL SERVICE
 NETWORK SERVICE
 SERVICE</RawString>
-    </Rule>
-    <Rule id="V-63891" severity="medium" conversionstatus="pass" title="WN10-UR-000115" dscresource="UserRightsAssignment">
-      <Constant>SeIncreaseBasePriorityPrivilege</Constant>
-      <Description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.
-
-Accounts with the "Increase scheduling priority" user right can change a scheduling priority causing performance issues or a DoS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
-      <DisplayName>Increase scheduling priority</DisplayName>
-      <DuplicateOf />
-      <Force>True</Force>
-      <Identity>Administrators,Window Manager\Window Manager Group</Identity>
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Verify the effective setting in Local Group Policy Editor.
-Run "gpedit.msc".
-
-Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.
-
-If any groups or accounts other than the following are granted the "Increase scheduling priority" user right, this is a finding:
-
-Administrators
-Window Manager\Window Manager Group</RawString>
     </Rule>
     <Rule id="V-63917" severity="medium" conversionstatus="pass" title="WN10-UR-000120" dscresource="UserRightsAssignment">
       <Constant>SeLoadDriverPrivilege</Constant>
diff --git a/StigData/Processed/WindowsDefender-All-1.7.org.default.xml b/source/StigData/Processed/WindowsDefender-All-1.7.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsDefender-All-1.7.org.default.xml
rename to source/StigData/Processed/WindowsDefender-All-1.7.org.default.xml
diff --git a/StigData/Processed/WindowsDefender-All-1.7.xml b/source/StigData/Processed/WindowsDefender-All-1.7.xml
similarity index 100%
rename from StigData/Processed/WindowsDefender-All-1.7.xml
rename to source/StigData/Processed/WindowsDefender-All-1.7.xml
diff --git a/StigData/Processed/WindowsDefender-All-1.6.org.default.xml b/source/StigData/Processed/WindowsDefender-All-1.8.org.default.xml
similarity index 95%
rename from StigData/Processed/WindowsDefender-All-1.6.org.default.xml
rename to source/StigData/Processed/WindowsDefender-All-1.8.org.default.xml
index 848d0e274..dd9083e07 100644
--- a/StigData/Processed/WindowsDefender-All-1.6.org.default.xml
+++ b/source/StigData/Processed/WindowsDefender-All-1.8.org.default.xml
@@ -5,7 +5,7 @@
     Each setting in this file is linked by STIG ID and the valid range is in an
     associated comment.
 -->
-<OrganizationalSettings fullversion="1.6">
+<OrganizationalSettings fullversion="1.8">
   <!-- Ensure 'V-75237' -ge '0' -and 'V-75237' -le '7'-->
   <OrganizationalSetting id="V-75237" ValueData="0" />
   <!-- Ensure 'V-75241' -ge '1' -and 'V-75241' -le '7'-->
diff --git a/StigData/Processed/WindowsDefender-All-1.6.xml b/source/StigData/Processed/WindowsDefender-All-1.8.xml
similarity index 95%
rename from StigData/Processed/WindowsDefender-All-1.6.xml
rename to source/StigData/Processed/WindowsDefender-All-1.8.xml
index 63230fde8..c580031ad 100644
--- a/StigData/Processed/WindowsDefender-All-1.6.xml
+++ b/source/StigData/Processed/WindowsDefender-All-1.8.xml
@@ -1,21 +1,24 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Windows_Defender_Antivirus" description="The Windows Defender Antivirus Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.  Comments or proposed revisions to this document should be send via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_Defender_Antivirus_STIG_V1R6_Manual-xccdf.xml" releaseinfo="Release: 6 Benchmark Date: 26 Jul 2019" title="MS Windows Defender Antivirus Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.6" created="12/5/2019">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Windows_Defender_Antivirus" description="The Windows Defender Antivirus Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.  Comments or proposed revisions to this document should be send via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.xml" releaseinfo="Release: 8 Benchmark Date: 24 Apr 2020" title="MS Windows Defender Antivirus Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.8" created="5/20/2020">
   <RegistryRule dscresourcemodule="PSDscResources">
     <Rule id="V-75147" severity="high" conversionstatus="pass" title="SRG-APP-000279" dscresource="RegistryPolicyFile">
-      <Description>&lt;VulnDiscussion&gt;After enabling this feature, Potentially Unwanted Application (PUA) protection blocking takes effect on endpoint clients after the next signature update or computer restart. Signature updates take place daily under typical circumstances. PUA will be blocked and automatically quarantined.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <Description>&lt;VulnDiscussion&gt;After enabling this feature, PUA protection blocking takes effect on endpoint clients after the next signature update or computer restart. Signature updates take place daily under typical circumstances. PUA will be blocked and automatically quarantined.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <Ensure>Present</Ensure>
       <IsNullOrEmpty>False</IsNullOrEmpty>
-      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\MpEngine</Key>
+      <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender</Key>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Verify the policy value for Computer Configuration -&gt; Administrative Templates -&gt; MS Security Guide -&gt; "Turn on Windows Defender protection against Potentially Unwanted Applications" is set to "Enabled".
+      <RawString>Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; "Configure detection for potentially unwanted applications" is set to "Enabled" and "Block".
 
-Procedure: Use the Windows Registry Editor to navigate to the following key: 
-HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine
+Use the Windows Registry Editor to navigate to the following key: 
+
+HKLM\Software\Policies\Microsoft\Windows Defender
 
-Criteria: If the value "MpEnablePus" is REG_DWORD = 1, this is not a finding.</RawString>
+If the value "PUAProtection" does not exist, this is a finding.
+
+If the value "PUAProtection" is REG_DWORD = 1, this is not a finding.</RawString>
       <ValueData>1</ValueData>
-      <ValueName>MpEnablePus</ValueName>
+      <ValueName>PUAProtection</ValueName>
       <ValueType>Dword</ValueType>
     </Rule>
     <Rule id="V-75151" severity="medium" conversionstatus="pass" title="SRG-APP-000279" dscresource="RegistryPolicyFile">
@@ -56,9 +59,9 @@ HKLM\Software\Policies\Microsoft\Windows Defender
 
 Criteria: If the value "DisableAntiSpyware" does not exist, this is not a finding.
 
-For Windows Server 2016:
+For Windows Server 2016/Windows Server 2019:
 Note: This only applies when a third-party antivirus solution is enforced on the system.
-Due to changes from Microsoft in the Server 2016 architecture, Windows Defender Antivirus will not disable itself when other antivirus products are detected. Microsoft has also removed API's for other Antivirus software to cleanly stop and disable Windows Defender AV. This was a design choice by Microsoft to maximize protection in Server 2016. 
+Due to changes from Microsoft in the Server 2016/Server 2019 architecture, Windows Defender Antivirus will not disable itself when other antivirus products are detected. Microsoft has also removed API's for other Antivirus software to cleanly stop and disable Windows Defender AV. This was a design choice by Microsoft to maximize protection in Server 2016/Server 2019. 
 
 If there is a third-party antivirus product enforced on the system, the Windows Defender Antivirus must be uninstalled. 
 
@@ -172,23 +175,23 @@ Criteria: If the value "DisableBlockAtFirstSeen" is REG_DWORD = 0, this is not a
       <ValueType>Dword</ValueType>
     </Rule>
     <Rule id="V-75167" severity="medium" conversionstatus="pass" title="SRG-APP-000210" dscresource="RegistryPolicyFile">
-      <Description>&lt;VulnDiscussion&gt;This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default)  (0x1) Basic membership (0x2) Advanced membership    Basic membership will send basic information to Microsoft about software that has been detected including where the software came from the actions that you apply or that are applied automatically and whether the actions were successful. Advanced membership in addition to basic information will send more information to Microsoft about malicious software spyware and potentially unwanted software including the location of the software file names how the software operates and how it has impacted your computer. If you enable this setting you will join Microsoft MAPS with the membership specified. If you disable or do not configure this setting you will not join Microsoft MAPS. In Windows 10 Basic membership is no longer available so setting the value to 1 or 2 enrolls the device into Advanced membership.
+      <Description>&lt;VulnDiscussion&gt;This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default) (0x1) Basic membership (0x2) Advanced membership Basic membership will send basic information to Microsoft about software that has been detected including where the software came from the actions that you apply or that are applied automatically and whether the actions were successful. Advanced membership in addition to basic information will send more information to Microsoft about malicious software spyware and potentially unwanted software including the location of the software file names how the software operates and how it has impacted your computer. If you enable this setting you will join Microsoft MAPS with the membership specified. If you disable or do not configure this setting you will not join Microsoft MAPS. In Windows 10 Basic membership is no longer available so setting the value to 1 or 2 enrolls the device into Advanced membership.
 
-Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this feature will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting disables Microsoft Active Protection Service membership and reporting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <Ensure>Present</Ensure>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <Key>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet</Key>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This is applicable to unclassified systems, for other systems this is Not Applicable.
+      <RawString>This is applicable to unclassified systems, for other systems this is NA.
 
-Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; MAPS "Join Microsoft MAPS" is set to "Enabled" and "Advanced MAPS" is selected.
+Verify the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender Antivirus &gt;&gt; MAPS &gt;&gt; "Join Microsoft MAPS" is set to "Enabled" and "Advanced MAPS" selected from the drop down box.
 
 Procedure: Use the Windows Registry Editor to navigate to the following key: 
 HKLM\Software\Policies\Microsoft\Windows Defender\Spynet
 
-Criteria: If the value "SpynetReporting" is “REG_DWORD = 2”, this is not a finding.
+Criteria: If the value "SpynetReporting" is REG_DWORD = 2, this is not a finding.
 </RawString>
       <ValueData>2</ValueData>
       <ValueName>SpynetReporting</ValueName>
diff --git a/StigData/Processed/WindowsDnsServer-2012R2-1.13.org.default.xml b/source/StigData/Processed/WindowsDnsServer-2012R2-1.13.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsDnsServer-2012R2-1.13.org.default.xml
rename to source/StigData/Processed/WindowsDnsServer-2012R2-1.13.org.default.xml
diff --git a/StigData/Processed/WindowsDnsServer-2012R2-1.13.xml b/source/StigData/Processed/WindowsDnsServer-2012R2-1.13.xml
similarity index 100%
rename from StigData/Processed/WindowsDnsServer-2012R2-1.13.xml
rename to source/StigData/Processed/WindowsDnsServer-2012R2-1.13.xml
diff --git a/StigData/Processed/WindowsDnsServer-2012R2-1.12.org.default.xml b/source/StigData/Processed/WindowsDnsServer-2012R2-1.14.org.default.xml
similarity index 89%
rename from StigData/Processed/WindowsDnsServer-2012R2-1.12.org.default.xml
rename to source/StigData/Processed/WindowsDnsServer-2012R2-1.14.org.default.xml
index 4d8337feb..979f25635 100644
--- a/StigData/Processed/WindowsDnsServer-2012R2-1.12.org.default.xml
+++ b/source/StigData/Processed/WindowsDnsServer-2012R2-1.14.org.default.xml
@@ -5,7 +5,7 @@
     Each setting in this file is linked by STIG ID and the valid range is in an
     associated comment.
 -->
-<OrganizationalSettings fullversion="1.12">
+<OrganizationalSettings fullversion="1.14">
   <!-- Ensure ValueData is set to 255 which disables IPv6 -->
   <OrganizationalSetting id="V-58627" ValueData="" />
 </OrganizationalSettings>
diff --git a/StigData/Processed/WindowsDnsServer-2012R2-1.12.xml b/source/StigData/Processed/WindowsDnsServer-2012R2-1.14.xml
similarity index 97%
rename from StigData/Processed/WindowsDnsServer-2012R2-1.12.xml
rename to source/StigData/Processed/WindowsDnsServer-2012R2-1.14.xml
index 8637b115a..71e6a73d5 100644
--- a/StigData/Processed/WindowsDnsServer-2012R2-1.12.xml
+++ b/source/StigData/Processed/WindowsDnsServer-2012R2-1.14.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Microsoft_Windows_2012_Server_Domain_Name_System_STIG" description="The Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_Server_DNS_STIG_V1R12_Manual-xccdf.xml" releaseinfo="Release: 12 Benchmark Date: 26 Jul 2019" title="Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.12" created="12/5/2019">
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="Microsoft_Windows_2012_Server_Domain_Name_System_STIG" description="The Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_Microsoft_Windows_2012_Server_DNS_STIG_V1R14_Manual-xccdf.xml" releaseinfo="Release: 14 Benchmark Date: 24 Apr 2020" title="Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.14" created="5/28/2020">
   <DnsServerRootHintRule dscresourcemodule="PSDscResources">
     <Rule id="V-58615" severity="medium" conversionstatus="pass" title="SRG-APP-000516-DNS-000102" dscresource="Script">
       <Description>&lt;VulnDiscussion&gt;All caching name servers must be authoritative for the root zone because, without this starting point, they would have no knowledge of the DNS infrastructure and thus would be unable to respond to any queries. The security risk is that an adversary could change the root hints and direct the caching name server to a bogus root server. At that point, every query response from that name server is suspect, which would give the adversary substantial control over the network communication of the name servers' clients. When authoritative servers are sent queries for zones that they are not authoritative for, and they are configured as a non-caching server (as recommended), they can either be configured to return a referral to the root servers or they can be configured to refuse to answer the query. The recommendation is to configure authoritative servers to refuse to answer queries for any zones for which they are not authoritative. This is more efficient for the server and allows it to spend more of its resources doing what its intended purpose is, answering authoritatively for its zone.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -73,7 +73,7 @@ To guard against poisoning, name servers authoritative for .mil domains should b
       <PropertyValue>$True</PropertyValue>
       <RawString>Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
 
-Note: In Windows 2008 DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
+Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
 
 If forwarders are not used, recursion must be disabled.
 
@@ -106,7 +106,7 @@ To guard against poisoning, name servers authoritative for .mil domains should b
       <PropertyValue>$True</PropertyValue>
       <RawString>Note: If the Windows DNS server is in the classified network, this check is Not Applicable.
 
-Note: In Windows 2008 DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
+Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.
 
 If forwarders are not used, recursion must be disabled. In both cases, the use of root hints must be disabled.
 
@@ -173,7 +173,7 @@ The exceptions are glue records supporting zone delegations, CNAME records suppo
 If resource records are maintained that resolve to a fully qualified domain name in another zone, and the usage is not for resource records resolving to hosts that are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with a documented and approved mission need, this is a finding.</RawString>
     </Rule>
     <Rule id="V-58621" severity="medium" conversionstatus="pass" title="SRG-APP-000516-DNS-000114" dscresource="None">
-      <Description>&lt;VulnDiscussion&gt;The use of CNAME records for exercises, tests, or zone-spanning aliases should be temporary (e.g., to facilitate a migration). When a host name is an alias for a record in another zone, an adversary has two points of attack: the zone in which the alias is defined and the zone authoritative for the alias's canonical name. This configuration also reduces the speed of client resolution because it requires a second lookup after obtaining the canonical name. Furthermore, in the case of an authoritative name server, this information is promulgated throughout the enterprise to caching servers and thus compounds the vulnerability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <Description>&lt;VulnDiscussion&gt;The use of CNAME records for exercises, tests, or zone-spanning (pointing to zones with lesser security) aliases should be temporary (e.g., to facilitate a migration) and not be in place for more than six months. When a host name is an alias for a record in another zone, an adversary has two points of attack: the zone in which the alias is defined and the zone authoritative for the alias's canonical name. This configuration also reduces the speed of client resolution because it requires a second lookup after obtaining the canonical name. Furthermore, in the case of an authoritative name server, this information is promulgated throughout the enterprise to caching servers and thus compounds the vulnerability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
@@ -190,7 +190,8 @@ Review the RRs to confirm that there are no CNAME records older than 6 months.
 
 The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms. In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated (AO approval of use of a commercial cloud offering would satisfy this requirement). Additional exceptions are CNAME records in a multi-domain Active Directory environment pointing to hosts in other internal domains in the same multi-domain environment.
 
-If there are zone-spanning CNAME records older than 6 months and the CNAME records resolve to anything other than fully qualified domain names for glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with an AO-approved and documented mission need, this is a finding.</RawString>
+If there are zone-spanning (i.e., zones of lesser security)CNAME records older than 6 months and the CNAME records resolve to anything other than fully qualified domain names for glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with an AO-approved and documented mission need, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58649" severity="medium" conversionstatus="pass" title="SRG-APP-000401-DNS-000051" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates).
@@ -212,9 +213,9 @@ If there is no local cache of revocation data, this is a finding.</RawString>
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>This requirement is not applicable for a Windows 2008 DNS Server which is only hosting AD-integrated zones.
+      <RawString>This requirement is not applicable for a Windows DNS Server which is only hosting AD-integrated zones.
 
-For a Windows 2008 DNS Server which hosts a mix of AD-integrated zones and manually maintained zones, ask the DNS database administrator if they maintain a separate database with record documentation for the non-AD-integrated zone information. The reviewer should check that the record's last verified date is less than one year prior to the date of the review.
+For a Windows DNS Server which hosts a mix of AD-integrated zones and manually maintained zones, ask the DNS database administrator if they maintain a separate database with record documentation for the non-AD-integrated zone information. The reviewer should check that the record's last verified date is less than one year prior to the date of the review.
 
 If a separate database with record documentation is not maintained for the non-AD-integrated zone information, this is a finding.
 
@@ -230,7 +231,8 @@ Review the zone records of the non-AD-integrated zones and compare to the separa
 
 Determine if any records have not been validated in over a year.
 
-If zone records exist which have not been validated in over a year, this is a finding.</RawString>
+If zone records exist which have not been validated in over a year, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58709" severity="medium" conversionstatus="pass" title="SRG-APP-000451-DNS-000069" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Failing to an unsecure condition negatively impacts application security and can lead to system compromise. Failure conditions include, for example, loss of communications among critical system components or between system components and operational facilities. Fail-safe procedures include, for example, alerting operator personnel and providing specific instructions on subsequent steps to take (e.g., do nothing, reestablish system settings, shutdown processes, restart the system, or contact designated organizational personnel).
@@ -258,9 +260,10 @@ If a component such as the DNSSEC or TSIG/SIG(0) signing capabilities were to fa
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Notification to system administrator is not configurable in Windows 2008. In order for system administrators to be notified when a component fails, the system administrator would need to implement a third-party monitoring system. At a minimum, the system administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
+      <RawString>Notification to system administrator is not configurable in Windows DNS Server. In order for system administrators to be notified when a component fails, the system administrator would need to implement a third-party monitoring system. At a minimum, the system administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
 
-If a third-party monitoring system is not in place to detect and notify the system administrator upon component failures and the system administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.</RawString>
+If a third-party monitoring system is not in place to detect and notify the system administrator upon component failures and the system administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58715" severity="medium" conversionstatus="pass" title="SRG-APP-000474-DNS-000073" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Notifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights.
@@ -272,7 +275,9 @@ The DNS server does not have the capability of shutting down or restarting the i
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Notification to system administrator is not configurable in Windows 2012. In order for administrator to be notified if functionality of DNSSEC/TSIG has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third-party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
+      <RawString>Note: If only zones hosted are AD-integrated zones, this check is not applicable.
+
+Notification to system administrator is not configurable in Windows 2012. In order for administrator to be notified if functionality of DNSSEC/TSIG has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third-party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
 
 If a third-party monitoring system is not in place to detect and notify the ISSO/ISSM/DNS administrator if functionality of DNSSEC/TSIG has been removed or broken and the ISSO/ISSM/DNS administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.</RawString>
     </Rule>
@@ -286,9 +291,10 @@ The DNS server should be configured to generate audit records whenever a self-te
       <OrganizationValueTestString />
       <RawString>Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network.
 
-Notification to system administrator is not configurable in Windows 2008. In order for ISSO/ISSM/DNS administrator to be notified if functionality of Secure Updates has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
+Notification to system administrator is not configurable in Windows DNS Server. In order for ISSO/ISSM/DNS administrator to be notified if functionality of Secure Updates has been removed or broken, the ISSO/ISSM/DNS administrator would need to implement a third party monitoring system. At a minimum, the ISSO/ISSM/DNS administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day.
 
-If a third party monitoring system is not in place to detect and notify the ISSO/ISSM/DNS administrator if functionality of Secure Updates has been removed or broken and the ISSO/ISSM/DNS administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.</RawString>
+If a third party monitoring system is not in place to detect and notify the ISSO/ISSM/DNS administrator if functionality of Secure Updates has been removed or broken and the ISSO/ISSM/DNS administrator does not have a documented procedure in place to review the diagnostic logs on a routine basis every day, this is a finding.
+</RawString>
     </Rule>
   </DocumentRule>
   <ManualRule dscresourcemodule="None">
@@ -425,11 +431,12 @@ This requirement only applies to applications that have a native backup capabili
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Consult with the System Administrator to determine the backup policy in place for Windows 2008 DNS Server.
+      <RawString>Consult with the System Administrator to determine the backup policy in place for Windows DNS Server.
 
 Review the backup methods used and determine if the backup's methods have been successful at backing up the audit records at least every seven days.
 
-If the organization does not have a backup policy in place for backing up the Windows 2008 DNS Server's audit records and/or the backup methods have not been successful at backing up the audit records at least every seven days, this is a finding.</RawString>
+If the organization does not have a backup policy in place for backing up the Windows DNS Server's audit records and/or the backup methods have not been successful at backing up the audit records at least every seven days, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58575" severity="medium" conversionstatus="pass" title="SRG-APP-000214-DNS-000079" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The best way for a zone administrator to minimize the impact of a key compromise is by limiting the validity period of RRSIGs in the zone and in the parent zone. This strategy limits the time during which an attacker can take advantage of a compromised key to forge responses. An attacker that has compromised a ZSK can use that key only during the KSK's signature validity interval. An attacker that has compromised a KSK can use that key for only as long as the signature interval of the RRSIG covering the DS RR in the delegating parent. These validity periods should be short, which will require frequent re-signing.
@@ -461,13 +468,14 @@ A network administrator may choose to use a "hidden" master authoritative server
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Windows 2008 DNS Servers that are Active Directory integrated must be located where required to meet the Active Directory services.
+      <RawString>Windows DNS Servers that are Active Directory integrated must be located where required to meet the Active Directory services.
 
-If all of the Windows 2008 DNS Servers are AD integrated, this check is Not Applicable.
+If all of the Windows DNS Servers are AD integrated, this check is Not Applicable.
 
-If any or all of the Windows 2008 DNS Servers are standalone and non-AD-integrated, verify with the System Administrator their geographic location.
+If any or all of the Windows DNS Servers are standalone and non-AD-integrated, verify with the System Administrator their geographic location.
 
-If any or all of the authoritative name servers are located in the same building as the master authoritative name server, and the master authoritative name server is not "hidden", this is a finding.</RawString>
+If any or all of the authoritative name servers are located in the same building as the master authoritative name server, and the master authoritative name server is not "hidden", this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58583" severity="medium" conversionstatus="pass" title="SRG-APP-000383-DNS-000047" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords.
@@ -478,7 +486,7 @@ To guard against poisoning, name servers specifically fulfilling the role of pro
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
       <RawString>Note: If Windows DNS server is not serving in a caching role, this check is Not Applicable.
-Verify the Windows 2008 DNS Server will only accept TCP and UDP port 53 traffic from specific IP addresses/ranges.
+Verify the Windows DNS Server will only accept TCP and UDP port 53 traffic from specific IP addresses/ranges.
 
 This can be configured via a local or network firewall.
 
@@ -633,7 +641,7 @@ nslookup &lt;enter&gt;;
 
 At the nslookup prompt, type:
 
-server=###.###.###.### &lt;enter&gt;;
+server ###.###.###.### &lt;enter&gt;;
 (where the ###.###.###.### is replaced by the IP of each NS record)
 
 Enter a FQDN for a known host record in the zone.
@@ -649,13 +657,15 @@ A network administrator may choose to use a "hidden" master authoritative server
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Windows 2008 DNS Servers that are Active Directory-integrated must be located where required to meet the Active Directory services.
+      <RawString>Windows DNS Servers that are Active Directory-integrated must be located where required to meet the Active Directory services.
+
+If all of the Windows DNS Servers are AD-integrated, this check is not applicable.
 
-If all of the Windows 2008 DNS Servers are AD-integrated, this check is not applicable.
+If any or all of the Windows DNS Servers are stand-alone and non-AD-integrated, verify with the System Administrator their geographic dispersal.
 
-If any or all of the Windows 2008 DNS Servers are stand-alone and non-AD-integrated, verify with the System Administrator their geographic dispersal.
+If all of the authoritative name servers are located on the same network segment, and the master authoritative name server is not "hidden", this is a finding.
 
-If all of the authoritative name servers are located on the same network segment, and the master authoritative name server is not "hidden", this is a finding.</RawString>
+</RawString>
     </Rule>
     <Rule id="V-58597" severity="medium" conversionstatus="pass" title="SRG-APP-000516-DNS-000088" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;The only protection approach for content control of a DNS zone file is the use of a zone file integrity checker. The effectiveness of integrity checking using a zone file integrity checker depends upon the database of constraints built into the checker. The deployment process consists of developing these constraints with the right logic, and the only determinant of the truth value of these logical predicates is the parameter values for certain key fields in the format of various RRTypes.
@@ -779,13 +789,15 @@ The other set, called internal name servers, is to be located within the firewal
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Consult with the System Administrator to review the external Windows 2008 DNS Server's HBSS firewall policy.
+      <RawString>Consult with the System Administrator to review the external Windows DNS Server's HBSS firewall policy.
 
 The inbound TCP and UDP ports 53 rule should be configured to only restrict IP addresses from the internal network.
 
 If the HBSS firewall policy is not configured with the restriction, consult with the network firewall administrator to confirm the restriction on the network firewall.
 
-If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block internal hosts from querying the external DNS server, this is a finding.</RawString>
+If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block internal hosts from querying the external DNS server, this is a finding.
+
+</RawString>
     </Rule>
     <Rule id="V-58607" severity="medium" conversionstatus="pass" title="SRG-APP-000516-DNS-000093" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers.
@@ -797,13 +809,14 @@ The other set, called internal name servers, is to be located within the firewal
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Consult with the System Administrator to review the internal Windows 2008 DNS Server's HBSS firewall policy.
+      <RawString>Consult with the System Administrator to review the internal Windows DNS Server's HBSS firewall policy.
 
 The inbound TCP and UDP ports 53 rule should be configured to only allow hosts from the internal network to query the internal DNS server.
 
 If the HBSS firewall policy is not configured with the restriction, consult with the network firewall administrator to confirm the restriction on the network firewall.
 
-If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block external hosts from querying the internal DNS server, this is a finding.</RawString>
+If neither the DNS server's HBSS firewall policy nor the network firewall is configured to block external hosts from querying the internal DNS server, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58609" severity="medium" conversionstatus="pass" title="SRG-APP-000516-DNS-000095" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Authoritative name servers (especially primary name servers) should be configured with an allow-transfer access control sub statement designating the list of hosts from which zone transfer requests can be accepted. These restrictions address the denial-of-service threat and potential exploits from unrestricted dissemination of information about internal resources. Based on the need-to-know, the only name servers that need to refresh their zone files periodically are the secondary name servers. Zone transfer from primary name servers should be restricted to secondary name servers. The zone transfer should be completely disabled in the secondary name servers. The address match list argument for the allow-transfer sub statement should consist of IP addresses of secondary name servers and stealth secondary name servers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -894,9 +907,10 @@ If internal and external DNS servers have not been implemented for zones which r
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Consult with the network IAVM scanner to confirm all Microsoft Operating System IAVMs applicable to Windows 2008/2008 R2 have been applied to the DNS server.
+      <RawString>Consult with the network IAVM scanner to confirm all Microsoft Operating System IAVMs have been applied to the Windows DNS server.
 
-If the Windows Operating System has not been patched to handle all IAVMs, this is a finding.</RawString>
+If all Microsoft Operating System IAVMs have not been applied to the DNS server, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58623" severity="medium" conversionstatus="pass" title="SRG-APP-000516-DNS-000500" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;IPv6 link-local scope addresses are not globally routable and must not be configured in any DNS zone.  Similar to RFC1918 addresses, if a link-local scope address is inserted into a zone provided to clients, most routers will not forward this traffic beyond the local subnet.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1014,9 +1028,9 @@ To meet the requirement for authentication between Windows DNS servers, IPsec wi
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Note: This requirement applies to any Windows 2008 DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
+      <RawString>Note: This requirement applies to any Windows DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too.
 
-If the Windows 2008 DNS Servers only host AD-integrated zones, this requirement is not applicable.
+If the Windows DNS Servers only host AD-integrated zones, this requirement is not applicable.
 
 Log on to the DNS server which hosts non-AD-integrated zones using the Domain Admin or Enterprise Admin account.
 
@@ -1042,7 +1056,8 @@ On the “Remote Computers” tab, Endpoint1 and Endpoint2 are configured with t
 
 On the “Protocols and Ports” tab, "Protocol type:" is set to either TCP (depending upon which rule is being reviewed) and the "Endpoint 1 port:" is set to "Specific ports" and "53".
 
-If there are not rules(s) configured with the specified requirements, this is a finding.</RawString>
+If there are not rules(s) configured with the specified requirements, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58635" severity="medium" conversionstatus="pass" title="SRG-APP-000394-DNS-000049" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Device authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.
@@ -2293,9 +2308,10 @@ The DNS server should perform self-tests, such as at server start-up, to confirm
       <OrganizationValueTestString />
       <RawString>This functionality should be performed by the Host Based Security System (HBSS), mandatory on all DoD systems.
 
-Check to ensure McAfee HBSS is installed and fully operational on the Windows 2008 DNS Server.
+Check to ensure McAfee HBSS is installed and fully operational on the Windows DNS Server.
 
-If all required HBSS products are not installed and/or the installed products are not enabled, this is a finding.</RawString>
+If all required HBSS products are not installed and/or the installed products are not enabled, this is a finding.
+</RawString>
     </Rule>
     <Rule id="V-58737" severity="medium" conversionstatus="pass" title="SRG-APP-000333-DNS-000104" dscresource="None">
       <Description>&lt;VulnDiscussion&gt;Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. Of course, these vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. Thus, it makes good business sense to run the latest version of name server software because theoretically it is the safest version.
@@ -2459,10 +2475,13 @@ SIG(0) is used for server-to-server authentication for DNS transactions, and it
 Navigate to the following location:
 
 %ALLUSERSPROFILE%\Microsoft\Crypto
+Note: If the %ALLUSERSPROFILE%\Microsoft\Crypto folder doesn't exist, this is not applicable.
 
 Verify the permissions on the keys folder, sub-folders, and files are limited to SYSTEM and Administrators FULL CONTROL.
 
-If any other user or group has greater than READ privileges to the %ALLUSERSPROFILE%\Microsoft\Crypto folder, sub-folders and files, this is a finding.</RawString>
+If any other user or group has greater than READ privileges to the %ALLUSERSPROFILE%\Microsoft\Crypto folder, sub-folders and files, this is a finding.
+
+</RawString>
     </Rule>
     <Rule id="V-58643" severity="medium" conversionstatus="pass" title="SRG-APP-000176-DNS-000018" dscresource="None">
       <AccessControlEntry>
@@ -2499,6 +2518,7 @@ Access Windows Explorer.
 Navigate to the following location:
 
 %ALLUSERSPROFILE%\Microsoft\Crypto
+Note: If the %ALLUSERSPROFILE%\Microsoft\Crypto folder doesn't exist, this is not applicable.
 
 Right-click on each sub-folder, choose “Properties”, click on the “Security” tab, and click on the “Advanced” button.
 
@@ -2537,11 +2557,11 @@ If any other user or group is listed as OWNER of the %ALLUSERSPROFILE%\Microsoft
 
 Navigate to the following location:
 %ALLUSERSPROFILE%\Microsoft\Crypto
+Note: If the %ALLUSERSPROFILE%\Microsoft\Crypto folder doesn't exist, this is not applicable.
 
 Verify the permissions on the folder, sub-folders and files are limited to “SYSTEM” and Administrators for “FULL CONTROL”.
 
 If any other user or group has greater than READ permissions to the %ALLUSERSPROFILE%\Microsoft\Crypto folder, sub-folders and files, this is a finding.
-
 </RawString>
     </Rule>
   </PermissionRule>
@@ -2554,7 +2574,9 @@ If any other user or group has greater than READ permissions to the %ALLUSERSPRO
       <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters</Key>
       <OrganizationValueRequired>True</OrganizationValueRequired>
       <OrganizationValueTestString>ValueData is set to 255 which disables IPv6 </OrganizationValueTestString>
-      <RawString>Log on to the DNS server using the Domain Admin or Enterprise Admin account.
+      <RawString>Note: If the Windows 2012 DNS server is hosting IPv6 records, this requirement is not applicable.
+
+Log on to the DNS server using the Domain Admin or Enterprise Admin account.
 
 From a command prompt, run regedit.
 In the User Account Control dialog box, click Continue.
diff --git a/StigData/Processed/WindowsFirewall-All-1.6.org.default.xml b/source/StigData/Processed/WindowsFirewall-All-1.6.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsFirewall-All-1.6.org.default.xml
rename to source/StigData/Processed/WindowsFirewall-All-1.6.org.default.xml
diff --git a/StigData/Processed/WindowsFirewall-All-1.6.xml b/source/StigData/Processed/WindowsFirewall-All-1.6.xml
similarity index 100%
rename from StigData/Processed/WindowsFirewall-All-1.6.xml
rename to source/StigData/Processed/WindowsFirewall-All-1.6.xml
diff --git a/StigData/Processed/WindowsFirewall-All-1.7.org.default.xml b/source/StigData/Processed/WindowsFirewall-All-1.7.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsFirewall-All-1.7.org.default.xml
rename to source/StigData/Processed/WindowsFirewall-All-1.7.org.default.xml
diff --git a/StigData/Processed/WindowsFirewall-All-1.7.xml b/source/StigData/Processed/WindowsFirewall-All-1.7.xml
similarity index 100%
rename from StigData/Processed/WindowsFirewall-All-1.7.xml
rename to source/StigData/Processed/WindowsFirewall-All-1.7.xml
diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.18.org.default.xml b/source/StigData/Processed/WindowsServer-2012R2-DC-2.18.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2012R2-DC-2.18.org.default.xml
rename to source/StigData/Processed/WindowsServer-2012R2-DC-2.18.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml b/source/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml
similarity index 99%
rename from StigData/Processed/WindowsServer-2012R2-DC-2.18.xml
rename to source/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml
index aa0d5fb3e..961fbd928 100644
--- a/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml
+++ b/source/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_DC_STIG" description="The Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml" releaseinfo="Release: 18 Benchmark Date: 25 Oct 2019" title="Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.18" created="12/17/2019">
+<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_DC_STIG" description="The Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml" releaseinfo="Release: 18 Benchmark Date: 25 Oct 2019" title="Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.18" created="4/21/2020">
   <AccountPolicyRule dscresourcemodule="SecurityPolicyDsc">
     <Rule id="V-1097" severity="medium" conversionstatus="pass" title="Bad Logon Attempts" dscresource="AccountPolicy">
       <Description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1661,29 +1661,40 @@ Backups shall be consistent with organizational recovery time and recovery point
       <OrganizationValueTestString />
       <RawString>Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives.  If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-73523.a" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
+    <Rule id="V-73523" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.
+
+Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+      <RawString>This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2.
+
+Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA.
+
+If the following registry value is not configured as specified, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\
-Type: REG_DWORD
+
 Value Name: Start
-Value: 0x00000004 (4)</RawString>
-    </Rule>
-    <Rule id="V-73523.b" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+
+Type: REG_DWORD
+Value: 0x00000004 (4)
+
+If the following registry value includes MRxSmb10, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\
-Type: REG_MULTI_SZ
+
 Value Name: DependOnService
-Value: Default values after removing MRxSmb10 include the following, which are not a finding:</RawString>
+
+Type: REG_MULTI_SZ
+Value: Default values after removing MRxSmb10 include the following, which are not a finding:
+Bowser
+MRxSmb20
+NSI</RawString>
     </Rule>
   </DocumentRule>
   <ManualRule dscresourcemodule="None">
diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.19.org.default.xml b/source/StigData/Processed/WindowsServer-2012R2-DC-2.19.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2012R2-DC-2.19.org.default.xml
rename to source/StigData/Processed/WindowsServer-2012R2-DC-2.19.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.19.xml b/source/StigData/Processed/WindowsServer-2012R2-DC-2.19.xml
similarity index 99%
rename from StigData/Processed/WindowsServer-2012R2-DC-2.19.xml
rename to source/StigData/Processed/WindowsServer-2012R2-DC-2.19.xml
index 68b63caa7..bbc0122de 100644
--- a/StigData/Processed/WindowsServer-2012R2-DC-2.19.xml
+++ b/source/StigData/Processed/WindowsServer-2012R2-DC-2.19.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_DC_STIG" description="The Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.xml" releaseinfo="Release: 19 Benchmark Date: 24 Jan 2020" title="Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.19" created="2/25/2020">
+<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_DC_STIG" description="The Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R19_Manual-xccdf.xml" releaseinfo="Release: 19 Benchmark Date: 24 Jan 2020" title="Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.19" created="4/21/2020">
   <AccountPolicyRule dscresourcemodule="SecurityPolicyDsc">
     <Rule id="V-1097" severity="medium" conversionstatus="pass" title="Bad Logon Attempts" dscresource="AccountPolicy">
       <Description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1661,29 +1661,40 @@ Backups shall be consistent with organizational recovery time and recovery point
       <OrganizationValueTestString />
       <RawString>Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives.  If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-73523.a" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
+    <Rule id="V-73523" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.
+
+Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+      <RawString>This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2.
+
+Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA.
+
+If the following registry value is not configured as specified, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\
-Type: REG_DWORD
+
 Value Name: Start
-Value: 0x00000004 (4)</RawString>
-    </Rule>
-    <Rule id="V-73523.b" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+
+Type: REG_DWORD
+Value: 0x00000004 (4)
+
+If the following registry value includes MRxSmb10, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\
-Type: REG_MULTI_SZ
+
 Value Name: DependOnService
-Value: Default values after removing MRxSmb10 include the following, which are not a finding:</RawString>
+
+Type: REG_MULTI_SZ
+Value: Default values after removing MRxSmb10 include the following, which are not a finding:
+Bowser
+MRxSmb20
+NSI</RawString>
     </Rule>
   </DocumentRule>
   <ManualRule dscresourcemodule="None">
diff --git a/StigData/Processed/WindowsServer-2012R2-MS-2.16.org.default.xml b/source/StigData/Processed/WindowsServer-2012R2-MS-2.16.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2012R2-MS-2.16.org.default.xml
rename to source/StigData/Processed/WindowsServer-2012R2-MS-2.16.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2012R2-MS-2.16.xml b/source/StigData/Processed/WindowsServer-2012R2-MS-2.16.xml
similarity index 99%
rename from StigData/Processed/WindowsServer-2012R2-MS-2.16.xml
rename to source/StigData/Processed/WindowsServer-2012R2-MS-2.16.xml
index e1cbe219a..0de223fa5 100644
--- a/StigData/Processed/WindowsServer-2012R2-MS-2.16.xml
+++ b/source/StigData/Processed/WindowsServer-2012R2-MS-2.16.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_MS_STIG" description="The Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.xml" releaseinfo="Release: 16 Benchmark Date: 26 Jul 2019" title="Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.16" created="9/6/2019">
+<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_MS_STIG" description="The Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R16_Manual-xccdf.xml" releaseinfo="Release: 16 Benchmark Date: 26 Jul 2019" title="Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.16" created="4/21/2020">
   <AccountPolicyRule dscresourcemodule="SecurityPolicyDsc">
     <Rule id="V-1097" severity="medium" conversionstatus="pass" title="Bad Logon Attempts" dscresource="AccountPolicy">
       <Description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1374,29 +1374,40 @@ Backups shall be consistent with organizational recovery time and recovery point
       <OrganizationValueTestString />
       <RawString>Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives.  If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-73523.a" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
+    <Rule id="V-73523" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.
+
+Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+      <RawString>This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2.
+
+Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA.
+
+If the following registry value is not configured as specified, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\
-Type: REG_DWORD
+
 Value Name: Start
-Value: 0x00000004 (4)</RawString>
-    </Rule>
-    <Rule id="V-73523.b" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+
+Type: REG_DWORD
+Value: 0x00000004 (4)
+
+If the following registry value includes MRxSmb10, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\
-Type: REG_MULTI_SZ
+
 Value Name: DependOnService
-Value: Default values after removing MRxSmb10 include the following, which are not a finding:</RawString>
+
+Type: REG_MULTI_SZ
+Value: Default values after removing MRxSmb10 include the following, which are not a finding:
+Bowser
+MRxSmb20
+NSI</RawString>
     </Rule>
   </DocumentRule>
   <ManualRule dscresourcemodule="None">
diff --git a/StigData/Processed/WindowsServer-2012R2-MS-2.17.org.default.xml b/source/StigData/Processed/WindowsServer-2012R2-MS-2.17.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2012R2-MS-2.17.org.default.xml
rename to source/StigData/Processed/WindowsServer-2012R2-MS-2.17.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2012R2-MS-2.17.xml b/source/StigData/Processed/WindowsServer-2012R2-MS-2.17.xml
similarity index 99%
rename from StigData/Processed/WindowsServer-2012R2-MS-2.17.xml
rename to source/StigData/Processed/WindowsServer-2012R2-MS-2.17.xml
index 2274da377..57a8be5b3 100644
--- a/StigData/Processed/WindowsServer-2012R2-MS-2.17.xml
+++ b/source/StigData/Processed/WindowsServer-2012R2-MS-2.17.xml
@@ -1,4 +1,4 @@
-<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_MS_STIG" description="The Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml" releaseinfo="Release: 17 Benchmark Date: 25 Oct 2019" title="Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.17" created="12/5/2019">
+<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="Windows_2012_MS_STIG" description="The Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml" releaseinfo="Release: 17 Benchmark Date: 25 Oct 2019" title="Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.17" created="4/21/2020">
   <AccountPolicyRule dscresourcemodule="SecurityPolicyDsc">
     <Rule id="V-1097" severity="medium" conversionstatus="pass" title="Bad Logon Attempts" dscresource="AccountPolicy">
       <Description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
@@ -1396,29 +1396,40 @@ Backups shall be consistent with organizational recovery time and recovery point
       <OrganizationValueTestString />
       <RawString>Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives.  If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.</RawString>
     </Rule>
-    <Rule id="V-73523.a" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
+    <Rule id="V-73523" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.
+
+Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
       <DuplicateOf />
       <IsNullOrEmpty>False</IsNullOrEmpty>
       <OrganizationValueRequired>False</OrganizationValueRequired>
       <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+      <RawString>This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2.
+
+Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA.
+
+If the following registry value is not configured as specified, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\
-Type: REG_DWORD
+
 Value Name: Start
-Value: 0x00000004 (4)</RawString>
-    </Rule>
-    <Rule id="V-73523.b" severity="medium" conversionstatus="pass" title="WIN00-000180" dscresource="None">
-      <Description />
-      <DuplicateOf />
-      <IsNullOrEmpty>False</IsNullOrEmpty>
-      <OrganizationValueRequired>False</OrganizationValueRequired>
-      <OrganizationValueTestString />
-      <RawString>Registry Hive: HKEY_LOCAL_MACHINE
+
+Type: REG_DWORD
+Value: 0x00000004 (4)
+
+If the following registry value includes MRxSmb10, this is a finding:
+
+Registry Hive: HKEY_LOCAL_MACHINE
 Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\
-Type: REG_MULTI_SZ
+
 Value Name: DependOnService
-Value: Default values after removing MRxSmb10 include the following, which are not a finding:</RawString>
+
+Type: REG_MULTI_SZ
+Value: Default values after removing MRxSmb10 include the following, which are not a finding:
+Bowser
+MRxSmb20
+NSI</RawString>
     </Rule>
   </DocumentRule>
   <ManualRule dscresourcemodule="None">
diff --git a/StigData/Processed/WindowsServer-2016-DC-1.10.org.default.xml b/source/StigData/Processed/WindowsServer-2016-DC-1.10.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-DC-1.10.org.default.xml
rename to source/StigData/Processed/WindowsServer-2016-DC-1.10.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2016-DC-1.10.xml b/source/StigData/Processed/WindowsServer-2016-DC-1.10.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-DC-1.10.xml
rename to source/StigData/Processed/WindowsServer-2016-DC-1.10.xml
diff --git a/StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml b/source/StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml
rename to source/StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2016-DC-1.9.xml b/source/StigData/Processed/WindowsServer-2016-DC-1.9.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-DC-1.9.xml
rename to source/StigData/Processed/WindowsServer-2016-DC-1.9.xml
diff --git a/StigData/Processed/WindowsServer-2016-MS-1.10.org.default.xml b/source/StigData/Processed/WindowsServer-2016-MS-1.10.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-MS-1.10.org.default.xml
rename to source/StigData/Processed/WindowsServer-2016-MS-1.10.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2016-MS-1.10.xml b/source/StigData/Processed/WindowsServer-2016-MS-1.10.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-MS-1.10.xml
rename to source/StigData/Processed/WindowsServer-2016-MS-1.10.xml
diff --git a/StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml b/source/StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml
rename to source/StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2016-MS-1.9.xml b/source/StigData/Processed/WindowsServer-2016-MS-1.9.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2016-MS-1.9.xml
rename to source/StigData/Processed/WindowsServer-2016-MS-1.9.xml
diff --git a/StigData/Processed/WindowsServer-2019-DC-1.2.org.default.xml b/source/StigData/Processed/WindowsServer-2019-DC-1.2.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-DC-1.2.org.default.xml
rename to source/StigData/Processed/WindowsServer-2019-DC-1.2.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2019-DC-1.2.xml b/source/StigData/Processed/WindowsServer-2019-DC-1.2.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-DC-1.2.xml
rename to source/StigData/Processed/WindowsServer-2019-DC-1.2.xml
diff --git a/StigData/Processed/WindowsServer-2019-DC-1.3.org.default.xml b/source/StigData/Processed/WindowsServer-2019-DC-1.3.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-DC-1.3.org.default.xml
rename to source/StigData/Processed/WindowsServer-2019-DC-1.3.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2019-DC-1.3.xml b/source/StigData/Processed/WindowsServer-2019-DC-1.3.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-DC-1.3.xml
rename to source/StigData/Processed/WindowsServer-2019-DC-1.3.xml
diff --git a/StigData/Processed/WindowsServer-2019-MS-1.2.org.default.xml b/source/StigData/Processed/WindowsServer-2019-MS-1.2.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-MS-1.2.org.default.xml
rename to source/StigData/Processed/WindowsServer-2019-MS-1.2.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2019-MS-1.2.xml b/source/StigData/Processed/WindowsServer-2019-MS-1.2.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-MS-1.2.xml
rename to source/StigData/Processed/WindowsServer-2019-MS-1.2.xml
diff --git a/StigData/Processed/WindowsServer-2019-MS-1.3.org.default.xml b/source/StigData/Processed/WindowsServer-2019-MS-1.3.org.default.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-MS-1.3.org.default.xml
rename to source/StigData/Processed/WindowsServer-2019-MS-1.3.org.default.xml
diff --git a/StigData/Processed/WindowsServer-2019-MS-1.3.xml b/source/StigData/Processed/WindowsServer-2019-MS-1.3.xml
similarity index 100%
rename from StigData/Processed/WindowsServer-2019-MS-1.3.xml
rename to source/StigData/Processed/WindowsServer-2019-MS-1.3.xml
diff --git a/source/StigData/Processed/vSphere-6.5-1.3.org.default.xml b/source/StigData/Processed/vSphere-6.5-1.3.org.default.xml
new file mode 100644
index 000000000..00a303720
--- /dev/null
+++ b/source/StigData/Processed/vSphere-6.5-1.3.org.default.xml
@@ -0,0 +1,15 @@
+<!--
+    The organizational settings file is used to define the local organizations
+    preferred setting within an allowed range of the STIG.
+
+    Each setting in this file is linked by STIG ID and the valid range is in an
+    associated comment.
+-->
+<OrganizationalSettings fullversion="1.3">
+  <!-- Ensure 'V-93955' is set to "Syslog.global.logHost" = "site specific log host"-->
+  <OrganizationalSetting id="V-93955" AdvancedSettings="" />
+  <!-- Ensure "'V-94037'" is set to "Syslog.global.logDir" = "site specific log storage location"-->
+  <OrganizationalSetting id="V-94037" AdvancedSettings="" />
+  <!-- Ensure 'V-94039.b' is set to a string array of authoritative DoD time sources-->
+  <OrganizationalSetting id="V-94039.b" NtpServer="" />
+</OrganizationalSettings>
diff --git a/source/StigData/Processed/vSphere-6.5-1.3.xml b/source/StigData/Processed/vSphere-6.5-1.3.xml
new file mode 100644
index 000000000..435bc278c
--- /dev/null
+++ b/source/StigData/Processed/vSphere-6.5-1.3.xml
@@ -0,0 +1,1539 @@
+<DISASTIG version="1" classification="UNCLASSIFIED" customname="" stigid="VMware_vSphere_6-5_ESXi_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil." filename="U_VMware_vSphere_6-5_ESXi_STIG_V1R3_Manual-xccdf.xml" releaseinfo="Release: 3 Benchmark Date: 24 Jan 2020" title="VMware vSphere 6.5 ESXi Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="1.3" created="4/22/2020">
+  <DocumentRule dscresourcemodule="None">
+    <Rule id="V-94025" severity="low" conversionstatus="pass" title="SRG-OS-000104-VMM-000500" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configuration &gt;&gt; System &gt;&gt; Advanced System Settings. Click Edit and select the Config.HostAgent.plugins.hostsvc.esxAdminsGroup value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" keyword is set to "ESX Admins", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94079" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;In order to communicate with virtual switches in VST mode, external switch ports must be configured as trunk ports. VST mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. The auto or desirable physical switch settings do not work with the ESXi Server because the physical switch communicates with the ESXi Server using DTP. The non-negotiate and on options unconditionally enable VLAN trunking on the physical switch and create a VLAN trunk link between the ESXi Server and the physical switch. The difference between non-negotiate and on options is that on mode still sends out DTP frames, whereas the non-negotiate option does not.  The non-negotiate option should be used for all VLAN trunks, to minimize unnecessary network traffic for virtual switches in VST mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of external switch ports as trunk ports must be documented. Virtual Switch Tagging (VST) mode does not support Dynamic Trunking Protocol (DTP), so the trunk must be static and unconditional. Inspect the documentation and verify that the documentation is correct and updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream external switch ports.
+
+If DTP is enabled on the physical switch ports connected to the ESXi Host, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94081" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Since VMware virtual switches do not support STP, the ESXi host-connected physical switch ports must have portfast configured if spanning tree is enabled to avoid loops within the physical switch network. If these are not set, potential performance and connectivity issues might arise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that spanning tree protocol is disabled and/or portfast is configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's spanning tree protocol is not disabled or portfast is not configured for all physical ports connected to ESXi hosts, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94083" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When defining a physical switch port for trunk mode, only specified VLANs must be configured on the VLAN trunk link. The risk with not fully documenting all VLANs on the vSwitch is that it is possible that a physical trunk port might be configured without needed VLANs, or with unneeded VLANs, potentially enabling an administrator to either accidentally or maliciously connect a VM to an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Note that this check refers to an entity outside the physical scope of the ESXi server system. The configuration of upstream physical switches must be documented to ensure that unneeded VLANs are configured for all physical ports connected to ESXi hosts. Inspect the documentation and verify that the documentation is updated on an organization defined frequency and/or whenever modifications are made to either ESXi hosts or the upstream physical switches. Alternatively, log in to the physical switch and verify that only needed VLANs are configured for all physical ports connected to ESXi hosts.
+
+If the physical switch's configuration is trunked VLANs that are not used by ESXi for all physical ports connected to ESXi hosts, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94509" severity="low" conversionstatus="pass" title="SRG-OS-000109-VMM-000550" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value is set to "ESX Admins", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94533" severity="low" conversionstatus="pass" title="SRG-OS-000112-VMM-000560" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and verify it is NOT set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value is set to "ESX Admins", this is a finding.</RawString>
+    </Rule>
+  </DocumentRule>
+  <ManualRule dscresourcemodule="None">
+    <Rule id="V-93949" severity="medium" conversionstatus="pass" title="SRG-OS-000027-VMM-000080" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Enabling lockdown mode disables direct access to an ESXi host requiring the host be managed remotely from vCenter Server. This is done to ensure the roles and access controls implemented in vCenter are always enforced and users cannot bypass them by logging into a host directly. By forcing all interaction to occur through vCenter Server, the risk of someone inadvertently attaining elevated privileges or performing tasks that are not properly audited is greatly reduced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Scroll down to "Lockdown Mode" and verify it is set to Enabled (Normal or Strict).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}
+
+If Lockdown Mode is disabled, this is a finding. 
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-93953" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;In vSphere you can add users to the Exception Users list from the vSphere Web Client. These users do not lose their permissions when the host enters lockdown mode. Usually you may want to add service accounts such as a backup agent to the Exception Users list. Verify that the list of users who are exempted from losing permissions is legitimate and as needed per your environment. Users who do not require special permissions should not be exempted from lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under lockdown mode review the exception users list.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following script:
+
+$vmhost = Get-VMHost | Get-View
+$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
+$lockdown.QueryLockdownExceptions()
+
+If the Exception users list contains accounts that do not require special permissions, this is a finding.
+
+Note - This list is not intended for system administrator accounts but for special circumstances such as a service account.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-93965" severity="medium" conversionstatus="pass" title="SRG-OS-000023-VMM-000060" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Banner" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Banner /etc/issue", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93967" severity="medium" conversionstatus="pass" title="SRG-OS-000033-VMM-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Approved algorithms should impart some level of confidence in their implementation. Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.
+
+Note: This does not imply FIPS 140-2 validation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command from an SSH session connected to the ESXi host, or from the ESXi shell: 
+
+# grep -i "^Ciphers" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Ciphers aes128-ctr,aes192-ctr,aes256-ctr", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93969" severity="high" conversionstatus="pass" title="SRG-OS-000033-VMM-000140" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used. Only SSH protocol version 2 connections should be permitted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Protocol" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Protocol 2", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93971" severity="medium" conversionstatus="pass" title="SRG-OS-000107-VMM-000530" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via ".rhosts" files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^IgnoreRhosts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "IgnoreRhosts yes", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93973" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptographic host-based authentication is more secure than ".rhosts" authentication, since hosts are cryptographically authenticated. However, it is not recommended that hosts unilaterally trust one another, even within an organization.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^HostbasedAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "HostbasedAuthentication no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93975" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitRootLogin" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitRootLogin no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93977" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitEmptyPasswords" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitEmptyPasswords no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93979" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitUserEnvironment" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitUserEnvironment no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93981" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MACs" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93983" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system’s GSSAPI to remote hosts, increasing the attack surface of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GSSAPIAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GSSAPIAuthentication no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93985" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Kerberos authentication for SSH is often implemented using GSSAPI.  If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation.  Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation.  To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^KerberosAuthentication" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "KerberosAuthentication no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93987" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If other users have access to modify user-specific SSH configuration files, they may be able to log into the system as another user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^StrictModes" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "StrictModes yes", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93989" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^Compression" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "Compression no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93991" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs. Gateway ports allow remote forwarded ports to bind to non-loopback addresses on the server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^GatewayPorts" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "GatewayPorts no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93993" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;X11 forwarding over SSH allows for the secure remote execution of X11-based applications. This feature can increase the attack surface of an SSH connection.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^X11Forwarding" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "X11Forwarding no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93995" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Environment variables can be used to change the behavior of remote sessions and should be limited. Locale environment variables that specify the language, character set, and other features modifying the operation of software to match the user's preferences.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^AcceptEnv" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "AcceptEnv", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93997" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;OpenSSH has the ability to create network tunnels (layer-2 and layer-3) over an SSH connection. This function can provide similar convenience to a Virtual Private Network (VPN) with the similar risk of providing a path to circumvent firewalls and network ACLs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^PermitTunnel" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "PermitTunnel no", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93999" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;This ensures a user login will be terminated as soon as the "ClientAliveCountMax" is reached.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveCountMax" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveCountMax 3", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94001" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Causing idle users to be automatically logged out guards against compromises one system leading trivially to compromises on another.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^ClientAliveInterval" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "ClientAliveInterval 200", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94003" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The SSH protocol has the ability to provide multiple sessions over a single connection without reauthentication. A compromised client could use this feature to establish additional sessions to a system without consent or knowledge of the user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^MaxSessions" /etc/ssh/sshd_config
+
+If there is no output or the output is not exactly "MaxSessions 1", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94005" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;ESXi hosts come with SSH which can be enabled to allow remote access without requiring user authentication.  To enable password free access copy the remote users public key into the "/etc/ssh/keys-root/authorized_keys" file on the ESXi host.  The presence of the remote user's public key in the "authorized_keys" file identifies the user as trusted, meaning the user is granted access to the host without providing a password.  If using Lockdown Mode and SSH is disabled then login with authorized keys will have the same restrictions as username/password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# ls -la /etc/ssh/keys-root/authorized_keys
+
+or
+
+# cat /etc/ssh/keys-root/authorized_keys
+
+If the authorized_keys file exists and is not empty, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94011" severity="medium" conversionstatus="pass" title="SRG-OS-000077-VMM-000440" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If the remember setting is not set or is not "remember=5", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94013" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The use of unapproved algorithms may result in weak password hashes more vulnerable to compromise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:
+
+# grep -i "^password" /etc/pam.d/passwd | grep sufficient
+
+If sha512 is not listed, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94021" severity="low" conversionstatus="pass" title="SRG-OS-000104-VMM-000500" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services.  Verify the Directory Services Type is set to Active Directory.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For systems that do not use Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
+
+If the Directory Services Type is not set to "Active Directory", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94023" severity="medium" conversionstatus="pass" title="SRG-OS-000104-VMM-000500" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Security and Services &gt;&gt; Security Settings &gt;&gt; Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; Join Domain Method. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if JoinADEnabled is True then JoinDomainMethod should be "FixedCAMConfigOption".
+
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-94027" severity="low" conversionstatus="pass" title="SRG-OS-000107-VMM-000530" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Authentication Services and view the Smart Card Authentication status. If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94043" severity="medium" conversionstatus="pass" title="SRG-OS-000423-VMM-001700" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;While encrypted vMotion is available now vMotion traffic should still be sequestered from other traffic to further protect it from attack. This network must be only be accessible to other ESXi hosts preventing outside access to the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The vMotion VMKernel port group should in a dedicated VLAN that can be on a common standard or distributed virtual switch as long as the vMotion VLAN is not shared by any other function and it not routed to anything but ESXi hosts.  The check for this will be unique per environment.  From the vSphere Client select the ESXi host and go to Configuration &gt; Networking and review the VLAN associated with the vMotion VMkernel(s) and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If long distance or cross vCenter vMotion is used the vMotion network can be routable but must be accessible to only the intended ESXi hosts.
+
+If the vMotion port group is not on an isolated VLAN and/or is routable to systems other than ESXi hosts, this is a finding.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-94047" severity="medium" conversionstatus="pass" title="SRG-OS-000423-VMM-001700" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI and NFS. This configuration might expose IP-based storage traffic to unauthorized virtual machine users. IP-based storage frequently is not encrypted. It can be viewed by anyone with access to this network. To restrict unauthorized users from viewing the IP-based storage traffic, the IP-based storage network must be logically separated from the production traffic. Configuring the IP-based storage adaptors on separate VLANs or network segments from other VMkernels and Virtual Machines will limit unauthorized users from viewing the traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>IP-Based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a common standard or distributed virtual switch that is logically separated from other traffic types.  The check for this will be unique per environment.  
+
+From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; VMkernel adapters and review the VLANs associated with any IP-Based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.
+
+If any IP-Based storage networks are not isolated from other traffic types, this is a finding.
+
+If IP-based storage is not used, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-94051" severity="low" conversionstatus="pass" title="SRG-OS-000423-VMM-001700" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;There are three different TCP/IP stacks by default available on ESXi now which are Default, Provisioning, and vMotion.  To better protect and isolate sensitive network traffic within ESXi admins must configure each of these stacks.  Additional custom TCP/IP stacks can be created if desired.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; TCP/IP configuration. Review the default system TCP/IP stacks and verify they are configured with the appropriate IP address information.
+
+If vMotion and Provisioning VMKernels are in use and are not utilizing their own TCP/IP stack, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94055" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;When enabled, vSphere performs bidirectional authentication of both the iSCSI target and host. There is a potential for a MiTM attack, when not authenticating both the iSCSI target and host, in which an attacker might impersonate either side of the connection to steal data. Bidirectional authentication mitigates this risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Storage &gt;&gt; Storage Adapters &gt;&gt; Select the iSCSI adapter &gt;&gt; Properties &gt;&gt; Authentication method and view the CHAP configuration and verify CHAP is "Required" for target and host authentication.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostHba | Where {$_.Type -eq "iscsi"} | Select AuthenticationProperties -ExpandProperty AuthenticationProperties
+
+If iSCSI is not used, this is not a finding.
+
+If iSCSI is used and CHAP is not set to "Required" for both the target and host, this is a finding.
+
+If iSCSI is used and unique CHAP secrets are not used for each host, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94059" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access. Reduce the risk by configuring the ESXi firewall to only allow access from authorized networks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under the Firewall section click Edit and for each enabled service click Firewall and review the allowed IPs. Check this for Incoming and Outgoing connections.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostFirewallException | Where {$_.Enabled -eq $true} | Select Name,Enabled,@{N="AllIPEnabled";E={$_.ExtensionData.AllowedHosts.AllIP}}
+
+If for an enabled service "Allow connections from any IP address" is selected, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94061" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;In addition to service specific firewall rules ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic.  Reduce the risk of attack by making sure this is set to deny incoming and outgoing traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostFirewallDefaultPolicy
+
+If the Incoming or Outgoing policies are True, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94349" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server.  Place this user in the Exception Users list.  When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server. Place this user in the Exception Users list. When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.
+
+From the Host Client, select the ESXi host, right click and go to "Permissions". Verify the CIM account user role is limited to read only and CIM permissions.
+
+If there is no dedicated CIM account and the root is used for CIM monitoring, this is a finding.
+
+If write access is not required and the access level is not "read-only", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94477" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Always check the SHA1 or MD5 hash after downloading an ISO, offline bundle, or patch to ensure integrity and authenticity of the downloaded files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>The downloaded ISO, offline bundle, or patch hash must be verified against the vendor's checksum to ensure the integrity and authenticity of the files. 
+
+See some typical command line example(s) for both the md5 and sha1 hash check(s) directly below.
+
+# md5sum &lt;filename&gt;.iso
+# sha1sum &lt;filename&gt;.iso
+
+If any of the system's downloaded ISO, offline bundle, or system patch hashes cannot be verified against the vendor's checksum, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94479" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>If vCenter Update Manager is used on the network it can be used to scan all hosts for missing patches.  From the vSphere Client go to Hosts and Clusters &gt; Update Manager tab and select scan to view all hosts compliance status.
+
+If vCenter Update Manager is not used a hosts compliance status must be manually determined by the build number.  The following VMware KB 1014508 can be used to correlate patches with build numbers.
+
+If the ESXi host does not have the latest patches, this is a finding.
+
+If the ESXi host is not on a supported release, this is a finding.
+
+VMware also publishes Advisories on security patches, and offers a way to subscribe to email alerts for them.
+https://www.vmware.com/support/policies/security_response</RawString>
+    </Rule>
+    <Rule id="V-94481" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;TLS 1.0 and 1.1 are deprecated protocols with well published shortcomings and vulnerabilities. TLS 1.2 should be enabled on all interfaces and SSLv3, TL 1.1 and 1.0 disabled where supported. Mandating TLS 1.2 may break third party integrations and add-ons to vSphere. Test these integrations carefully after implementing TLS 1.2 and roll back where appropriate. On interfaces where required functionality is broken with TLS 1.2 this finding is N/A until such time as the third party software supports TLS 1.2.
+
+Make sure you modify TLS settings in the following order: 1. Platform Services Controllers (if applicable), 2. vCenter, 3. ESXi&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+grep "enableTLS" /etc/sfcb/sfcb.cfg
+
+If the output indicates that any protocol is enabled other than TLSv1_2, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94487" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Secure Boot is a protocol of UEFI firmware that ensures the integrity of the boot process from hardware up through to the OS. Secure Boot for ESXi requires support from the firmware and it requires that all ESXi kernel modules, drivers, and VIBs be signed by VMware or a partner subordinate.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+/usr/lib/vmware/secureboot/bin/secureBoot.py -s
+
+If the output is not Enabled, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94489" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;The default self-signed, VMCA issued host certificate must be replaced with a DoD-approved certificate. The use of a DoD certificate on the host assures clients that the service they are connecting to is legitimate and properly secured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>Temporarily enable SSH, connect to the ESXi host and run the following command:
+
+# openssl x509 -in /etc/vmware/ssl/rui.crt -text | grep Issuer
+
+If the issuer is not a DoD approved certificate authority, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94505" severity="low" conversionstatus="pass" title="SRG-OS-000109-VMM-000550" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser"", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-94507" severity="medium" conversionstatus="pass" title="SRG-OS-000109-VMM-000550" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles and select a Host Profile to edit. View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomain Method. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if JoinADEnabled is True then JoinDomainMethod should be "FixedCAMConfigOption".
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If vSphere Authentication Proxy is not used to join hosts to an Active Directory domain, this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-94511" severity="low" conversionstatus="pass" title="SRG-OS-000376-VMM-001520" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and view the "Enable Smart Card Authentication" status.
+
+If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94529" severity="low" conversionstatus="pass" title="SRG-OS-000112-VMM-000560" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-94531" severity="medium" conversionstatus="pass" title="SRG-OS-000112-VMM-000560" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles and select a Host Profile to edit. View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomainMethod. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if "JoinADEnabled" is "True" then "JoinDomainMethod" should be "FixedCAMConfigOption".
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If vSphere Authentication Proxy is not used to join hosts to an Active Directory domain, this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.
+</RawString>
+    </Rule>
+    <Rule id="V-94535" severity="low" conversionstatus="pass" title="SRG-OS-000377-VMM-001530" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that have no local user accounts, other than "root" and/or "vpxuser", this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and view the Smart Card Authentication status.
+
+If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94543" severity="low" conversionstatus="pass" title="SRG-OS-000113-VMM-000570" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi host configuration, ensures password complexity and reuse policies are enforced and reduces the risk of security breaches and unauthorized access.  Note: If the AD group "ESX Admins" (default) exists then all users and groups that are assigned as members to this group will have full administrative access to all ESXi hosts the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Authentication Services. Verify the "Directory Services Type" is set to "Active Directory".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostAuthentication
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Directory Services Type" is not set to "Active Directory", this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-94545" severity="medium" conversionstatus="pass" title="SRG-OS-000113-VMM-000570" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are saved in the host profile and are transmitted over the network. To avoid having to save Active Directory credentials in the Host Profile and to avoid transmitting Active Directory credentials over the network use the vSphere Authentication Proxy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+From the vSphere Client go to Home &gt;&gt; Host Profiles &gt;&gt; and select a Host Profile to edit. View the settings under Authentication Configuration &gt;&gt; Active Directory Configuration &gt;&gt; JoinDomainMethod. Verify the method used to join hosts to a domain is set to "Use vSphere Authentication Proxy to add the host to domain".
+
+or
+
+From a PowerCLI command prompt while connected to vCenter run the following command:
+
+Get-VMHost | Select Name, ` @{N="HostProfile";E={$_ | Get-VMHostProfile}}, ` @{N="JoinADEnabled";E={($_ | Get-VmHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory.Enabled}}, ` @{N="JoinDomainMethod";E={(($_ | Get-VMHostProfile).ExtensionData.Config.ApplyProfile.Authentication.ActiveDirectory | Select -ExpandProperty Policy | Where {$_.Id -eq "JoinDomainMethodPolicy"}).Policyoption.Id}}
+
+Verify if "JoinADEnabled" is "True" then "JoinDomainMethod" should be "FixedCAMConfigOption".
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If vSphere Authentication Proxy is not used to join hosts to an Active Directory domain, this is a finding.
+If you are not using Host Profiles to join active directory, this is not a finding.</RawString>
+    </Rule>
+    <Rule id="V-94549" severity="low" conversionstatus="pass" title="SRG-OS-000403-VMM-001640" dscresource="None">
+      <Description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.
+
+From the vSphere Web Client select the ESXi host and go to Manage &gt;&gt; Authentication Services and view the Smart Card Authentication status.
+
+If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain.
+
+For systems that do not use smart cards with Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.</RawString>
+    </Rule>
+  </ManualRule>
+  <VsphereAcceptanceLevelRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94041" severity="high" conversionstatus="pass" title="SRG-OS-000366-VMM-001430" dscresource="VMHostAcceptanceLevel">
+      <Description>&lt;VulnDiscussion&gt;Verify the ESXi Image Profile to only allow signed VIBs.  An unsigned VIB represents untested code installed on an ESXi host.  The ESXi Image profile supports four acceptance levels: 
+
+(1) VMwareCertified - VIBs created, tested and signed by VMware
+(2) VMwareAccepted - VIBs created by a VMware partner but tested and signed by VMware, 
+(3) PartnerSupported - VIBs created, tested and signed by a certified VMware partner 
+(4) CommunitySupported - VIBs that have not been tested by VMware or a VMware partner.  
+
+Community Supported VIBs are not supported and do not have a digital signature.  To protect the security and integrity of your ESXi hosts do not allow unsigned (CommunitySupported) VIBs to be installed on your hosts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Level>PartnerSupported</Level>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under "Host Image Profile Acceptance Level" view the acceptance level.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.software.acceptance.get()
+
+If the acceptance level is CommunitySupported, this is a finding.</RawString>
+    </Rule>
+  </VsphereAcceptanceLevelRule>
+  <VsphereAdvancedSettingsRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-93951" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'DCUI.Access' = 'root'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Lockdown mode disables direct host access requiring that admins manage hosts from vCenter Server.  However, if a host becomes isolated from vCenter Server, the admin is locked out and can no longer manage the host. If you are using normal lockdown mode, you can avoid becoming locked out of an ESXi host that is running in lockdown mode, by setting DCUI.Access to a list of highly trusted users who can override lockdown mode and access the DCUI. The DCUI is not running in strict lockdown mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the DCUI.Access value and verify only the root user is listed.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.
+
+If the DCUI.Access is not restricted to root, this is a finding.
+
+Note: This list is only for local user accounts and should only contain the root user.
+
+For environments that do not use vCenter server to manage ESXi, this is not applicable.</RawString>
+    </Rule>
+    <Rule id="V-93955" severity="medium" conversionstatus="pass" title="SRG-OS-000032-VMM-000130" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>
+      </AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Remote logging to a central log host provides a secure, centralized store for ESXi logs. By gathering host log files onto a central host it can more easily monitor all hosts with a single tool. It can also do aggregate analysis and searching to look for such things as coordinated attacks on multiple hosts. Logging to a secure, centralized log server also helps prevent log tampering and also provides a long-term audit record.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} is set to "Syslog.global.logHost" = "site specific log host"</OrganizationValueTestString>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Syslog.global.logHost value and verify it is set to a site specific syslog server hostname.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost
+
+If the Syslog.global.logHost setting is not set to a site specific syslog server, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93957" severity="medium" conversionstatus="pass" title="SRG-OS-000021-VMM-000050" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Security.AccountLockFailures' = '3'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountLockFailures value and verify it is set to 3.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures and verify it is set to 3.
+
+If the Security.AccountLockFailures is set to a value other than 3, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93959" severity="medium" conversionstatus="pass" title="SRG-OS-000329-VMM-001180" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Security.AccountUnlockTime' = '900'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Security.AccountUnlockTime value and verify it is set to 900.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime and verify it is set to 900.
+
+If the Security.AccountUnlockTime is set to a value other than 900, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93961" severity="medium" conversionstatus="pass" title="SRG-OS-000023-VMM-000060" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Annotations.WelcomeMessage' = 'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+-At any time, the USG may inspect and seize data stored on this IS.
+
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests- -not for your personal benefit or privacy.
+
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Annotations.WelcomeMessage value and verify it contains the DoD logon banner to follow.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage
+
+Check for either of the following login banners based on the character limitations imposed by the system. An exact match of the text is required. If one of these banners is not displayed, this is a finding.
+
+You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
+
+By using this IS (which includes any device attached to this IS), you consent to the following conditions:
+
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
+
+-At any time, the USG may inspect and seize data stored on this IS.
+
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
+
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests- -not for your personal benefit or privacy.
+
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
+
+OR
+
+I've read &amp; consent to terms in IS user agreem't.
+
+If the DCUI logon screen does not display the DoD logon banner, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-93963" severity="medium" conversionstatus="pass" title="SRG-OS-000023-VMM-000060" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Config.Etc.issue' = 'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.Etc.issue value and verify it is set to DoD logon banner below.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue
+
+If the Config.Etc.issue setting (/etc/issue file) does not contain the logon banner exactly as shown below this is a finding.
+
+"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."</RawString>
+    </Rule>
+    <Rule id="V-94007" severity="low" conversionstatus="pass" title="SRG-OS-000037-VMM-000150" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Config.HostAgent.log.level' = 'info'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings.  Select the Config.HostAgent.log.level value and verify it is set to "info".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level
+
+If the Config.HostAgent.log.level setting is not set to info, this is a finding.
+
+Note: Verbose logging level is acceptable for troubleshooting purposes.</RawString>
+    </Rule>
+    <Rule id="V-94009" severity="medium" conversionstatus="pass" title="SRG-OS-000069-VMM-000360" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Security.PasswordQualityControl' = 'similar=deny retry=3 min=disabled,disabled,disabled,disabled,15'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of complex passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques. Complexity requirements increase the password search space by requiring users to construct passwords from a larger character set than they may otherwise use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Security.PasswordQualityControl value and verify it is set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15"
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Security.PasswordQualityControl
+
+If the Security.PasswordQualityControl setting is not set to "similar=deny retry=3 min=disabled,disabled,disabled,disabled,15", this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94015" severity="medium" conversionstatus="pass" title="SRG-OS-000095-VMM-000480" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Config.HostAgent.plugins.solo.enableMob' = 'false'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;The Managed Object Browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host and enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK, but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access.  By default this is disabled for ESXi in version 6.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Config.HostAgent.plugins.solo.enableMob value and verify it is set to false.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob
+
+If the Config.HostAgent.plugins.solo.enableMob setting is not set to false, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94029" severity="medium" conversionstatus="pass" title="SRG-OS-000163-VMM-000700" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'UserVars.ESXiShellInteractiveTimeOut' = '600'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;If a user forgets to log out of their SSH session, the idle connection will remains open indefinitely, increasing the potential for someone to gain privileged access to the host.  The ESXiShellInteractiveTimeOut allows you to automatically terminate idle shell sessions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellInteractiveTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellInteractiveTimeOut
+
+If the UserVars.ESXiShellInteractiveTimeOut setting is not set to 600, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94031" severity="medium" conversionstatus="pass" title="SRG-OS-000163-VMM-000700" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'UserVars.ESXiShellTimeOut' = '600'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;When the ESXi Shell or SSH services are enabled on a host they will run indefinitely.  To avoid having these services left running set the ESXiShellTimeOut.  The ESXiShellTimeOut defines a window of time after which the ESXi Shell and SSH services will automatically be terminated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.ESXiShellTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut
+
+If the UserVars.ESXiShellTimeOut setting is not set to 600, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94033" severity="medium" conversionstatus="pass" title="SRG-OS-000163-VMM-000700" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'UserVars.DcuiTimeOut' = '600'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;When the Direct console user interface (DCUI) is enabled and logged in it should be automatically logged out if left logged in to avoid unauthorized privilege gains.  The DcuiTimeOut defines a window of time after which the DCUI will be logged out.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the UserVars.DcuiTimeOut value and verify it is set to 600 (10 Minutes).
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut
+
+If the UserVars.DcuiTimeOut setting is not set to 600, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94037" severity="medium" conversionstatus="pass" title="SRG-OS-000341-VMM-001220" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>
+      </AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;ESXi can be configured to store log files on an in-memory file system.  This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done only a single day's worth of logs are stored at any time. In addition log files will be reinitialized upon each reboot.  This presents a security risk as user activity logged on the host is only stored temporarily and will not persistent across reboots.  This can also complicate auditing and make it harder to monitor events and diagnose issues.  ESXi host logging should always be configured to a persistent datastore.
+
+Note: Scratch space is configured automatically during installation or first boot of an ESXi host, and does not usually need to be manually configured. ESXi Installable creates a 4 GB Fat16 partition on the target device during installation if there is sufficient space, and if the device is considered Local.  If ESXi is installed on an SD card or USB device a persistent log location may not be configured upon install as normal.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>"{0}" is set to "Syslog.global.logDir" = "site specific log storage location"</OrganizationValueTestString>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Syslog.global.logDir value and verify it is set to a persistent location.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir
+
+or
+
+$esxcli = Get-EsxCli
+$esxcli.system.syslog.config.get() | Select LocalLogOutput,LocalLogOutputIsPersistent
+
+If the Syslog.global.logDir or LocalLogOutput value is not on persistent storage, this is a finding.
+
+If the LocalLogOutputIsPersistent value is not true, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94057" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Mem.ShareForceSalting' = '2'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try and determine an AES encryption key in use on another virtual machine running on the same physical processor of the host server if Transparent Page Sharing is enabled between the two virtual machines. This technique works only in a highly controlled system configured in a non-standard way that VMware believes would not be recreated in a production environment.
+
+Even though VMware believes information being disclosed in real world conditions is unrealistic, out of an abundance of caution upcoming ESXi Update releases will no longer enable TPS between Virtual Machines by default (TPS will still be utilized within individual VMs).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Mem.ShareForceSalting value and verify it is set to 2.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Mem.ShareForceSalting
+
+If the Mem.ShareForceSalting setting is not set to 2, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94063" severity="low" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Net.BlockGuestBPDU' = '1'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected to reduce the STP convergence delay. If a BPDU packet is sent from a virtual machine on the ESXi host to the physical switch so configured, a cascading lockout of all the uplink interfaces from the ESXi host can occur. To prevent this type of lockout, BPDU Filter can be enabled on the ESXi host to drop any BPDU packets being sent to the physical switch. The caveat is that certain SSL VPN which use Windows bridging capability can legitimately generate BPDU packets. The administrator should verify that there are no legitimate BPDU packets generated by virtual machines on the ESXi host prior to enabling BPDU Filter.  If BPDU Filter is enabled in this situation, enabling Reject Forged Transmits on the virtual switch port group adds protection against Spanning Tree loops.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.BlockGuestBPDU value and verify it is set to 1.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU
+
+If the Net.BlockGuestBPDU setting is not set to 1, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94071" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'Net.DVFilterBindIpAddress' = ''</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;If you are not using products that make use of the dvfilter network API, the host should not be configured to send network information to a VM. If the API is enabled an attacker might attempt to connect a VM to it thereby potentially providing access to the network of other VMs on the host. If you are using a product that makes use of this API then verify that the host has been configured correctly. If you are not using such a product make sure the setting is blank.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Select the Net.DVFilterBindIpAddress value and verify the value is blank or the correct IP address of a security appliance if in use.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Net.DVFilterBindIpAddress
+
+If the Net.DVFilterBindIpAddress is not blank and security appliances are not in use on the host, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94483" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>'UserVars.ESXiVPsDisabledProtocols' = 'tlsv1,tlsv1.1,sslv3'</AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;TLS 1.0 and 1.1 are deprecated protocols with well published shortcomings and vulnerabilities. TLS 1.2 should be enabled on all interfaces and SSLv3, TL 1.1 and 1.0 disabled where supported. Mandating TLS 1.2 may break third party integrations and add-ons to vSphere. Test these integrations carefully after implementing TLS 1.2 and roll back where appropriate. On interfaces where required functionality is broken with TLS 1.2 this finding is N/A until such time as the third party software supports TLS 1.2.
+
+Make sure you modify TLS settings in the following order: 1. Platform Services Controllers (if applicable), 2. vCenter, 3. ESXi&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client, select the host and then click Configure &gt;&gt; System &gt;&gt; Advanced System Settings. Find the UserVars.ESXiVPsDisabledProtocols value and verify that it is set to the following:
+
+tlsv1,tlsv1.1,sslv3
+
+If the value is not set as above or it does not exist, this is a finding.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiVPsDisabledProtocols
+
+If the value returned is not "tlsv1,tlsv1.1,sslv3" or the setting does not exist, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94547" severity="low" conversionstatus="pass" title="SRG-OS-000113-VMM-000570" dscresource="VMHostAdvancedSettings">
+      <AdvancedSettings>
+      </AdvancedSettings>
+      <Description>&lt;VulnDiscussion&gt;When adding ESXi hosts to Active Directory, if the group "ESX Admins" exists, all user/group accounts assigned to the group will have full administrative access to the host. Discretion should be used when managing membership to the "ESX Admins" group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>For systems that do not use Active Directory and have no local user accounts, other than root and/or vpxuser, this is not applicable.
+
+From the vSphere Client select the ESXi host and go to Configuration &gt;&gt; Advanced Settings.  Select the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value and verify it is not set to "ESX Admins".
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.hostsvc.esxAdminsGroup
+
+For systems that do not use Active Directory and do have local user accounts, other than "root" and/or "vpxuser", this is a finding.
+
+If the "Config.HostAgent.plugins.hostsvc.esxAdminsGroup" value is set to "ESX Admins", this is a finding.</RawString>
+    </Rule>
+  </VsphereAdvancedSettingsRule>
+  <VsphereKernelActiveDumpPartitionRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94035" severity="low" conversionstatus="pass" title="SRG-OS-000269-VMM-000950" dscresource="VMHostKernelActiveDumpPartition">
+      <Description>&lt;VulnDiscussion&gt;In the event of a system failure, the system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Enabled>$true</Enabled>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and right click.  If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+$esxcli = Get-EsxCli
+$esxcli.system.coredump.partition.get()
+$esxcli.system.coredump.network.get()
+
+The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables. 
+
+If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.</RawString>
+    </Rule>
+  </VsphereKernelActiveDumpPartitionRule>
+  <VsphereNtpSettingsRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94039.b" severity="medium" conversionstatus="pass" title="SRG-OS-000355-VMM-001330" dscresource="VMHostNtpSettings">
+      <Description>&lt;VulnDiscussion&gt;To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <NtpServer />
+      <OrganizationValueRequired>True</OrganizationValueRequired>
+      <OrganizationValueTestString>{0} is set to a string array of authoritative DoD time sources</OrganizationValueTestString>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to verify the configured NTP servers and service startup policy.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostNTPServer
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"}
+
+If the NTP service is not configured with authoritative DoD time sources and the service is not configured to start and stop with the host and is running, this is a finding.</RawString>
+    </Rule>
+  </VsphereNtpSettingsRule>
+  <VspherePortGroupSecurityRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94065.a" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated source MAC address at any time. This allows an operating system to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. 
+ 
+This means the virtual switch does not compare the source and effective MAC addresses. 
+ 
+To protect against MAC address impersonation, all virtual switches should have forged transmissions set to Reject. Reject Forged Transmit can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited>$true</ForgedTransmitsInherited>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Forged Transmits" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94067.a" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. Reject MAC Changes can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited>$true</MacChangesInherited>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "MAC Address Changes" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94069.a" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited>$true</AllowPromiscuousInherited>
+      <Description>&lt;VulnDiscussion&gt;When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that Portgroup. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting. Promiscous mode can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Promiscuous Mode" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94073" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;ESXi does not use the concept of native VLAN. Frames with VLAN specified in the port group will have a tag, but frames with VLAN not specified in the port group are not tagged and therefore will end up as belonging to native VLAN of the physical switch. For example, frames on VLAN 1 from a Cisco physical switch will be untagged, because this is considered as the native VLAN. However, frames from ESXi specified as VLAN 1 will be tagged with a "1"; therefore, traffic from ESXi that is destined for the native VLAN will not be correctly routed (because it is tagged with a "1" instead of being untagged), and traffic from the physical switch coming from the native VLAN will not be visible (because it is not tagged). If the ESXi virtual switch port group uses the native VLAN ID, traffic from those VMs will not be visible to the native VLAN on the switch, because the switch is expecting untagged traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to the native VLAN ID of the attached physical switch.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with the native VLAN of the ESXi hosts attached physical switch, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94075" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes all network frames to the guest VM without modifying the VLAN tags, leaving it up to the guest to deal with them. VLAN 4095 should be used only if the guest has been specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it might cause denial-of-service or allow a guest VM to interact with traffic on an unauthorized VLAN.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to 4095.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanID
+
+If any port group is configured with VLAN 4095 and is not documented as a needed exception, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94077" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssPortGroupSecurity">
+      <AllowPromiscuousInherited />
+      <Description>&lt;VulnDiscussion&gt;Certain physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001–1024 and 4094, while Nexus switches typically reserve 3968–4047 and 4094. Check with the documentation for your specific switch. Using a reserved VLAN might result in a denial of service on the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmitsInherited />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChangesInherited />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; Networking &gt;&gt; Virtual switches. For each virtual switch, review the port group VLAN tags and verify they are not set to a reserved VLAN ID.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VirtualPortGroup | Select Name, VLanId
+
+If any port group is configured with a reserved VLAN ID, this is a finding.</RawString>
+    </Rule>
+  </VspherePortGroupSecurityRule>
+  <VsphereServiceRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94017" severity="medium" conversionstatus="pass" title="SRG-OS-000095-VMM-000480" dscresource="VMHostService">
+      <Description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides temporary access to commands essential for server maintenance. Intended primarily for use in break-fix scenarios, the ESXi shell is well suited for checking and modifying configuration details, not always generally accessible, using the vSphere Client. The ESXi shell is accessible remotely using SSH by users with the Administrator role. Under normal operating conditions, SSH access to the host must be disabled as is the default.  As with the ESXi shell, SSH is also intended only for temporary use during break-fix scenarios. SSH must therefore be disabled under normal operating conditions and must only be enabled for diagnostics or troubleshooting. Remote access to the host must therefore be limited to the vSphere Client at all other times.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>TSM-SSH</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Policy>off</Policy>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile. Under Services select Edit and view the "SSH" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "SSH"}
+
+If the ESXi SSH service is running, this is a finding.</RawString>
+      <Running>False</Running>
+    </Rule>
+    <Rule id="V-94019" severity="medium" conversionstatus="pass" title="SRG-OS-000095-VMM-000480" dscresource="VMHostService">
+      <Description>&lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>TSM</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Policy>off</Policy>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Security Profile.  Under Services select Edit and view the "ESXi Shell" service and verify it is stopped.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"}
+
+If the ESXi Shell service is running, this is a finding.</RawString>
+      <Running>False</Running>
+    </Rule>
+    <Rule id="V-94039.a" severity="medium" conversionstatus="pass" title="SRG-OS-000355-VMM-001330" dscresource="VMHostService">
+      <Description>&lt;VulnDiscussion&gt;To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <Key>ntpd</Key>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <Policy>Automatic</Policy>
+      <RawString>From the vSphere Web Client select the ESXi Host and go to Configure &gt;&gt; System &gt;&gt; Time Configuration. Click Edit to verify the configured NTP servers and service startup policy.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHost | Get-VMHostNTPServer
+Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"}
+
+If the NTP service is not configured with authoritative DoD time sources and the service is not configured to start and stop with the host and is running, this is a finding.</RawString>
+      <Running>True</Running>
+    </Rule>
+  </VsphereServiceRule>
+  <VsphereSnmpAgentRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94053" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostSnmpAgent">
+      <Description>&lt;VulnDiscussion&gt;If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <Enabled>$false</Enabled>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From a PowerCLI command prompt while connected to the ESXi host run the following command:
+
+Get-VMHostSnmp | Select *
+
+or
+
+From a console or ssh session run the follow command:
+
+esxcli system snmp get
+
+If SNMP is not in use and is enabled, this is a finding.
+
+If SNMP is enabled and read only communities is set to public, this is a finding.
+
+If SNMP is enabled and is not using v3 targets, this is a finding.
+
+Note: SNMP v3 targets can only be viewed and configured from the esxcli command.</RawString>
+    </Rule>
+  </VsphereSnmpAgentRule>
+  <VsphereVssSecurityRule dscresourcemodule="Vmware.vSphereDSC">
+    <Rule id="V-94065.b" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssSecurity">
+      <AllowPromiscuous />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated source MAC address at any time. This allows an operating system to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. 
+ 
+This means the virtual switch does not compare the source and effective MAC addresses. 
+ 
+To protect against MAC address impersonation, all virtual switches should have forged transmissions set to Reject. Reject Forged Transmit can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmits>$false</ForgedTransmits>
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChanges />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Forged Transmits" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Forged Transmits" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94067.b" severity="high" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssSecurity">
+      <AllowPromiscuous />
+      <Description>&lt;VulnDiscussion&gt;If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. Reject MAC Changes can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmits />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChanges>$false</MacChanges>
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "MAC Address Changes" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "MAC Address Changes" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+    <Rule id="V-94069.b" severity="medium" conversionstatus="pass" title="SRG-OS-000480-VMM-002000" dscresource="VMHostVssSecurity">
+      <AllowPromiscuous>$false</AllowPromiscuous>
+      <Description>&lt;VulnDiscussion&gt;When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that Portgroup. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting. Promiscous mode can be set at the vSwitch and/or the Portgroup level. You can override switch level settings at the Portgroup level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
+      <DuplicateOf />
+      <ForgedTransmits />
+      <IsNullOrEmpty>False</IsNullOrEmpty>
+      <MacChanges />
+      <OrganizationValueRequired>False</OrganizationValueRequired>
+      <OrganizationValueTestString />
+      <RawString>From the vSphere Web Client go to Configure &gt;&gt; Networking &gt;&gt; Virtual Switches. View the properties on each virtual switch and port group and verify "Promiscuous Mode" is set to reject.
+
+or
+
+From a PowerCLI command prompt while connected to the ESXi host run the following commands:
+
+Get-VirtualSwitch | Get-SecurityPolicy
+Get-VirtualPortGroup | Get-SecurityPolicy
+
+If the "Promiscuous Mode" policy is set to accept, this is a finding.</RawString>
+    </Rule>
+  </VsphereVssSecurityRule>
+</DISASTIG>
diff --git a/StigData/Schema/Checklist.xsd b/source/StigData/Schema/Checklist.xsd
similarity index 100%
rename from StigData/Schema/Checklist.xsd
rename to source/StigData/Schema/Checklist.xsd
diff --git a/StigData/Schema/PowerStig.xsd b/source/StigData/Schema/PowerStig.xsd
similarity index 100%
rename from StigData/Schema/PowerStig.xsd
rename to source/StigData/Schema/PowerStig.xsd
diff --git a/StigData/Schema/xccdf-1.1.4.xsd b/source/StigData/Schema/xccdf-1.1.4.xsd
similarity index 100%
rename from StigData/Schema/xccdf-1.1.4.xsd
rename to source/StigData/Schema/xccdf-1.1.4.xsd
diff --git a/source/build.psd1 b/source/build.psd1
new file mode 100644
index 000000000..77b0df183
--- /dev/null
+++ b/source/build.psd1
@@ -0,0 +1,5 @@
+@{
+    Path = 'PowerStig.psd1' #or build breaks on Linux
+}
+# Waiting for ModuleBuilder to do away with this file
+# when all parameters are provided to the function