Level 1 and Level 2 Settings¶
Most pages on this site mark settings as Level 1, Level 2, or BitLocker. The labels come from the CIS Microsoft Windows 11 Benchmark, the most widely used hardening standard for Windows, and they tell you what the trade-off is before you change anything.
What the labels mean¶
Level 1 is the baseline for any organization: a clear security benefit without getting in the way of normal use. Settings with no label are Level 1.
Level 2 is for high-security environments where security matters more than convenience. Level 2 settings limit remote management, turn off features that send data to cloud services, remove consumer features, and disable hardware and protocols a locked-down machine doesn't use. Level 2 builds on Level 1; you apply both.
BitLocker is an add-on to either level covering drive encryption and the device controls that go with it.
Level 2 on a competition image¶
Level 2 is where the README matters most, because several Level 2 settings break things a scenario may need. Before applying any of these, check:
| Level 2 setting | Breaks | Apply only if |
|---|---|---|
| Disable Server service | All file sharing from this machine | Nothing is shared |
| Disable Print Spooler | All printing | The machine doesn't print |
| Disable Remote Desktop Services | RDP | The README doesn't require remote access |
| Disable WinRM | PowerShell remoting, Server Manager remote | Same |
| Disable IPv6 | IPv6 networking | The network is IPv4 only (most are) |
| Turn off the Store | Installing Store apps | The README doesn't call for Store apps |
| Prevent OneDrive | OneDrive sync | OneDrive isn't part of the scenario |
| Disable camera | Webcam | No video calls in the scenario |
| Disable winget | Command-line app updates | Run your updates first, then apply |
Everything else in Level 2 can be applied on any image.
The STIG¶
The DISA STIG (Security Technical Implementation Guide) is the Department of Defense's hardening standard. CIS publishes a version of it as the CIS Windows 11 STIG Benchmark. It overlaps the CIS benchmark almost entirely, but it's stricter in a few places and adds a handful of settings. Where a page says STIG, the row comes from there.
STIG items carry a severity instead of a level: CAT I (an attacker could get in or take over directly), CAT II (a meaningful weakness), CAT III (a minor one). Where CIS and STIG give different values, the tables show both and say which to use.
The CIS numbers¶
Tables on this site include the benchmark's item number (for example, 2.3.11.6) so you can look up the full rationale, impact statement, and audit procedure in the benchmark itself. The benchmark is free from cisecurity.org.