Member Servers in a Domain¶
A member server is a Server 2022 machine joined to the domain but not a DC. It's hardened as a standalone server first (Windows Server 2022), then these settings, which the benchmark's Member Server profile adds or changes once the machine trusts a domain. Most of them also apply to a domain-joined Windows 11 workstation.
User rights on a member¶
| CIS | Right | Member value | Why |
|---|---|---|---|
| 2.2.3 | Access this computer from the network | Administrators, Authenticated Users | Same as standalone |
| 2.2.8 | Allow log on locally | Administrators | Same as standalone |
| 2.2.10 | Allow log on through Remote Desktop Services | Administrators, Remote Desktop Users | |
| 2.2.18 | Create symbolic links | Administrators (plus NT VIRTUAL MACHINE\Virtual Machines with Hyper-V) |
|
| 2.2.21 | Deny access to this computer from the network | Guests, Local account and member of Administrators group | A local administrator's password reused on another machine can't be used over the network to reach this one. This is the pass-the-hash blocker. |
| 2.2.26 | Deny log on through Remote Desktop Services | Guests, Local account | RDP is for domain accounts |
| 2.2.28 | Enable computer and user accounts to be trusted for delegation | No One | Only a DC configures delegation |
| 2.2.32 | Impersonate a client after authentication | Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE | |
| 2.2.38 | Manage auditing and security log | Administrators |
The STIG's deny-rights additions for Domain Admins and Enterprise Admins on the User Rights Assignment page apply here too: a Domain Admin who logs on to a member server leaves credentials in its memory, and the member is the machine most likely to be compromised first.
Security options on a member¶
| CIS | Setting | Value | Why |
|---|---|---|---|
| 2.3.1.1 | Accounts: Guest account status | Disabled | Same as standalone; listed separately because a DC has no local Guest |
| 2.3.7.6 | Interactive logon: Number of previous logons to cache | 4 or fewer (Level 2) | Each cached logon is a domain password hash on this machine's disk. A server is always next to its DC, so it needs almost none. |
| 2.3.7.8 | Interactive logon: Require Domain Controller Authentication to unlock workstation | Enabled | Unlocking checks with the DC, so an account disabled since the screen locked can't unlock it |
| 2.3.9.4 | Microsoft network server: Server SPN target name validation level | Accept if provided by client | Catches some SMB relay attacks; see Authentication Protocols |
| 2.3.10.2, 2.3.10.3 | Network access: Do not allow anonymous enumeration of SAM accounts (and shares) | Enabled | Same as standalone; a DC has no SAM |
| 2.3.10.11 | Network access: Restrict clients allowed to make remote calls to SAM | Administrators: Remote Access: Allow | Same as standalone |
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount /t REG_SZ /d 4 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ForceUnlockLogon /t REG_DWORD /d 1 /f
Administrative Templates on a member¶
All under Computer Configuration → Administrative Templates.
| CIS | Setting | Path | Value | Why |
|---|---|---|---|---|
| 18.4.1 | Apply UAC restrictions to local accounts on network logons | MS Security Guide | Enabled | A local administrator connecting over the network gets a filtered token, so the account can't be used for remote administration by an attacker who has its hash. Registry: LocalAccountTokenFilterPolicy = 0. |
| 18.6.21.2 | Prohibit connection to non-domain networks when connected to domain authenticated network | Network → Windows Connection Manager | Enabled | The machine can't bridge the domain network to another one |
| 18.9.5.5 | Turn On Virtualization Based Security: Credential Guard Configuration | System → Device Guard | Enabled with UEFI lock (Next Generation Windows Security) | On a member, Credential Guard is on; it's the DC where it's off. See Credential Protection. |
| 18.9.29.4 | Enumerate local users on domain-joined computers | System → Logon | Disabled | The sign-in screen doesn't list local accounts |
| 18.9.38.1 | Enable RPC Endpoint Mapper Client Authentication | System → Remote Procedure Call | Enabled | RPC clients must authenticate to the endpoint mapper before it tells them where a service lives |
| 18.9.38.2 | Restrict Unauthenticated RPC clients | System → Remote Procedure Call | Enabled: Authenticated (Level 2) | Anonymous RPC connections are refused |
| 18.9.53.1.2 | Enable Windows NTP Server | System → Windows Time Service → Time Providers | Disabled | Only the DC serves time to the domain. A member answering NTP is one more listening service. |
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" /v fBlockNonDomain /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnumerateLocalUsers /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" /v EnableAuthEpResolution /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" /v RestrictRemoteClients /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer" /v Enabled /t REG_DWORD /d 0 /f
LAPS: the local administrator password¶
Every member server still has a local Administrator account, and if two servers share the same local admin password, breaking one breaks both. Windows LAPS (built into Server 2022 since the April 2023 update) gives each machine its own random password, rotates it, and stores it in Active Directory where only authorized people can read it. The benchmark's LAPS items (18.9.26.1 to 18.9.26.8) are all under System → LAPS:
| CIS | Setting | Value | Why |
|---|---|---|---|
| 18.9.26.1 | Configure password backup directory | Enabled: Active Directory | The password goes into AD, not nowhere |
| 18.9.26.2 | Do not allow password expiration time longer than required by policy | Enabled | A manually extended expiry is cut back |
| 18.9.26.3 | Enable password encryption | Enabled | The password attribute in AD is encrypted, so a user who can read the computer object can't read it |
| 18.9.26.4 | Password Settings: Password Complexity | Large letters + small letters + numbers + specials | |
| 18.9.26.5 | Password Settings: Password Length | 15 or more | |
| 18.9.26.6 | Password Settings: Password Age (Days) | 30 or fewer | |
| 18.9.26.7 | Post-authentication actions: Grace period (hours) | 8 or fewer, not 0 | After someone uses the LAPS password, it's rotated within this many hours |
| 18.9.26.8 | Post-authentication actions: Actions | Reset the password and logoff the managed account (or higher) | Whoever used the password is signed out when it changes |
The policy is set in a domain GPO linked to the members' OU, and the schema needs the LAPS extension once per domain (Update-LapsADSchema, run as a Schema Admin on the DC). Verify from the DC that a password has been stored:
Get-LapsADPassword -Identity SERVER01 -AsPlainText
On a competition image, LAPS is usually not set up. The README decides whether setting it up is in scope; the Passwords and Expiry page covers the fallback of a strong unique password on each machine.
Group Policy from the member's side¶
gpresult /r lists the GPOs that applied and the groups the computer is in. A member that isn't picking up the domain policy is either in the wrong OU, blocked by an inheritance setting, or has lost its trust with the domain (Test-ComputerSecureChannel; repair with Test-ComputerSecureChannel -Repair -Credential (Get-Credential)).
Verify¶
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy
gpresult /r
Example¶
The README says FILES01 is a member server holding the department share. net user on it shows Administrator, Guest, and localadmin. The README lists no local accounts. localadmin is a domain-era leftover; remove it. CachedLogonsCount is 25; set it to 4. gpresult /r shows only Local Group Policy applied: the machine has fallen out of the domain. Test-ComputerSecureChannel returns False; repair it, gpupdate /force, and re-run gpresult.