hrdn-win-endp-cis-bnch

name	hrdn-win-endp-cis-bnch
description	Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","hardening","windows-security","CIS-benchmark","GPO","baseline-configuration"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Hardening Windows Endpoint with CIS Benchmark

When to Use

Use this skill when:

• Deploying new Windows 10/11 or Server 2019/2022 endpoints that require security hardening
• Establishing organization-wide security baselines using CIS Level 1 or Level 2 profiles
• Remediating findings from compliance audits (PCI DSS, HIPAA, SOC 2) that reference CIS benchmarks
• Validating existing endpoint configurations against current CIS benchmark versions

Do not use this skill for Linux endpoints (use hardening-linux-endpoint-with-cis-benchmark) or for cloud-native workloads that require CIS cloud benchmarks.

Prerequisites

• Windows 10/11 Enterprise or Windows Server 2019/2022 target endpoints
• Active Directory Group Policy Management Console (GPMC) for enterprise deployment
• CIS-CAT Pro Assessor or CIS-CAT Lite for automated benchmark assessment
• Administrative access to target endpoints or domain controller
• Current CIS Benchmark PDF for the target Windows version (download from cisecurity.org)

Workflow

Step 1: Select CIS Benchmark Profile Level

CIS provides two profile levels for Windows endpoints:

Level 1 (L1) - Corporate/Enterprise Environment:

• Practical hardening settings that can be applied to most organizations
• Minimal impact on functionality and user experience
• Covers: password policy, audit policy, user rights, security options, Windows Firewall

Level 2 (L2) - High Security/Sensitive Data:

• Includes all L1 settings plus additional restrictions
• May impact usability (disabling autorun, restricting remote desktop, enhanced audit logging)
• Appropriate for systems handling PII, PHI, PCI data, or classified information

Select profile based on data classification and risk tolerance of the endpoint.

Step 2: Import CIS GPO Baselines

CIS provides pre-built GPO templates (Build Kits) for each benchmark version:

# Download CIS Build Kit from CIS WorkBench (requires CIS SecureSuite membership)
# Extract the GPO backup to a staging directory

# Import the CIS GPO into Active Directory
Import-GPO -BackupGpoName "CIS Microsoft Windows 11 Enterprise v3.0.0 L1" `
  -TargetName "CIS-Win11-L1-Baseline" `
  -Path "C:\CIS-GPO-Backups\Win11-Enterprise" `
  -CreateIfNeeded

# Link GPO to target OU
New-GPLink -Name "CIS-Win11-L1-Baseline" `
  -Target "OU=Workstations,DC=corp,DC=example,DC=com" `
  -LinkEnabled Yes

Step 3: Apply Key CIS Benchmark Categories