GPO level guide: CIS Windows Benchmark to Group Policy mapping
Where each family of CIS Microsoft Windows Benchmark recommendations lives inside the Group Policy Management Editor, which configuration scope it applies to, and which items cannot be set through Group Policy at all.
What this guide is
CIS Microsoft Windows Benchmarks number every recommendation, but the number alone does not tell an administrator where to click. This page maps recommendation families to the Group Policy Object path and setting name used in the Group Policy Management Editor, so a finding such as 1.1.4 resolves to a concrete place in the console.
Paths follow the CIS Microsoft Windows Server 2022 and Windows 11 Enterprise benchmark structure. Section numbering shifts between benchmark versions and between the Server and client documents, so always confirm the number against the benchmark PDF you are assessing. This page never states a prescribed value; it maps location only.
How to apply a recommendation as a GPO
- 01Read the recommendation number
The leading number tells you which editor branch to open. 1.x and 2.x live under Security Settings, 17.x under Advanced Audit Policy Configuration, 18.x under Computer Administrative Templates, and 19.x under User Administrative Templates.
- 02Open the matching GPO branch
In Group Policy Management, create or edit a GPO linked to the OU holding the target computers, then walk the path in the table below. User Configuration settings apply to the OU holding the user accounts, not the computers.
- 03Set the value from the benchmark, not from this page
This guide maps where a setting lives. The prescribed value belongs to the CIS Benchmark PDF for your exact OS and benchmark version. Values differ between Level 1 and Level 2 and between Windows Server and Windows client benchmarks.
- 04Check the impact before you enforce
User Rights Assignment, LAN Manager authentication level, and SMB settings are the usual sources of breakage. Deploy to a pilot OU, watch for authentication and legacy application failures, then widen the link scope.
- 05Verify with a scan, not with the editor
gpresult /h and rsop.msc show what applied. A benchmark scan tells you what still fails. Import that scan here to see which recommendations remain open and why.
1.x - Account Policies
Password and lockout settings. On a domain, these are only effective when linked at the domain root through the Default Domain Policy or an equivalent GPO.
| Rec # | Recommendation | Level | Scope | Group Policy path and setting |
|---|---|---|---|---|
| 1.1.1 | Enforce password history | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Account Policies \ Password Policy Enforce password history |
| 1.1.2 | Maximum password age | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Account Policies \ Password Policy Maximum password age |
| 1.1.4 | Minimum password length | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Account Policies \ Password Policy Minimum password length |
| 1.1.5 | Password must meet complexity requirements | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Account Policies \ Password Policy Password must meet complexity requirements |
| 1.1.7 | Store passwords using reversible encryption | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Account Policies \ Password Policy Store passwords using reversible encryption |
| 1.2.2 | Account lockout threshold | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Account Policies \ Account Lockout Policy Account lockout threshold |
| 1.2.3 | Account lockout duration | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Account Policies \ Account Lockout Policy Account lockout duration |
2.x - Local Policies
User rights assignment and security options. These are the largest sections of the benchmark and the ones most likely to break an application when tightened without testing.
| Rec # | Recommendation | Level | Scope | Group Policy path and setting |
|---|---|---|---|---|
| 2.2.x | Access this computer from the network | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ User Rights Assignment Access this computer from the network |
| 2.2.x | Deny log on through Remote Desktop Services | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ User Rights Assignment Deny log on through Remote Desktop Services |
| 2.2.x | Debug programs | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ User Rights Assignment Debug programs |
| 2.3.1.1 | Accounts: Administrator account status | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options Accounts: Administrator account status |
| 2.3.1.2 | Accounts: Block Microsoft accounts | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options Accounts: Block Microsoft accounts |
| 2.3.7.x | Interactive logon: Machine inactivity limit | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options Interactive logon: Machine inactivity limit |
| 2.3.10.x | Network access: Do not allow anonymous enumeration of SAM accounts | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options Network access: Do not allow anonymous enumeration of SAM accounts |
| 2.3.11.x | Network security: LAN Manager authentication level | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options Network security: LAN Manager authentication level |
| 2.3.17.x | User Account Control: Behavior of the elevation prompt for administrators | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Local Policies \ Security Options User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode |
17.x - Advanced Audit Policy Configuration
Advanced audit subcategories. Pair these with 'Audit: Force audit policy subcategory settings to override audit policy category settings' under Security Options, or the legacy category policy wins.
| Rec # | Recommendation | Level | Scope | Group Policy path and setting |
|---|---|---|---|---|
| 17.1.1 | Audit Credential Validation | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Account Logon Audit Credential Validation |
| 17.2.x | Audit Security Group Management | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Account Management Audit Security Group Management |
| 17.3.x | Audit Process Creation | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Detailed Tracking Audit Process Creation |
| 17.5.x | Audit Logon / Logoff | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Logon/Logoff Audit Logon, Audit Logoff, Audit Special Logon |
| 17.9.x | Audit Security State Change | Level 1 | Computer | Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ System Audit Security State Change |
18.x and 19.x - Administrative Templates
ADMX-backed settings. Section 18 is Computer Configuration, section 19 is User Configuration. These require the matching ADMX files in the central store for the policy to appear in the editor.
| Rec # | Recommendation | Level | Scope | Group Policy path and setting |
|---|---|---|---|---|
| 18.4.x | Configure SMB v1 client driver | Level 1 | Computer | Computer Configuration \ Policies \ Administrative Templates \ MS Security Guide Configure SMB v1 client driver |
| 18.8.x | Turn on PowerShell Script Block Logging | Level 1 | Computer | Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ Windows PowerShell Turn on PowerShell Script Block Logging |
| 18.9.x | Configure Attack Surface Reduction rules | Level 1 | Computer | Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ Microsoft Defender Antivirus \ Microsoft Defender Exploit Guard \ Attack Surface Reduction Configure Attack Surface Reduction rules |
| 18.9.x | Do not allow passwords to be saved (RDP) | Level 1 | Computer | Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ Remote Desktop Services \ Remote Desktop Connection Client Do not allow passwords to be saved |
| 18.9.x | Application, Security and System log maximum size | Level 1 | Computer | Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ Event Log Service \ Security Specify the maximum log file size (KB) |
| 18.10.x | Allow Windows Ink Workspace above the lock screen | Level 2 | Computer | Computer Configuration \ Policies \ Administrative Templates \ Windows Components \ Windows Ink Workspace Allow Windows Ink Workspace |
| 19.1.3.x | Enable screen saver with password protection | Level 1 | User | User Configuration \ Policies \ Administrative Templates \ Control Panel \ Personalization Password protect the screen saver |
| 19.7.x | Do not preserve zone information in file attachments | Level 1 | User | User Configuration \ Policies \ Administrative Templates \ Windows Components \ Attachment Manager Do not preserve zone information in file attachments |
Recommendations that are not GPO settings
Not every benchmark item has a Group Policy equivalent. Treating these as GPO work produces a plan that silently under-delivers, so track them separately.
- BitLocker recovery escrow and TPM configuration, where the benchmark expects MBAM or Intune rather than a plain GPO value.
- Settings that only exist as MDM CSPs on modern Windows client builds, which have no ADMX equivalent.
- Local account and service account hygiene items assessed by inspection rather than by a policy value.
- Third-party product settings shipped in the benchmark as manual configuration steps.
Next step
Once your GPOs are linked, re-scan and work the remaining failures. The sample scan shows the register and remediation views without an account, and the crosswalk shows how CIS recommendations relate to DISA STIG rules through NIST SP 800-53.