Windows Server 2022¶
The server images in the early rounds are standalone: no Active Directory, no domain. A standalone Server 2022 machine is hardened almost exactly like a Windows 11 machine, and every page on this site applies unless this page says otherwise. The differences come from the CIS Microsoft Windows Server 2022 Standalone Benchmark v2.0.0, which is the server version of the Windows 11 benchmark used everywhere else on the site.
What's the same¶
Account policies, security options, audit policy, firewall, SMB, network hardening, UAC, credential protection, Defender, updates, and the Administrative Template settings are the same items with the same values. Of the 342 recommendations in the server benchmark, all but a handful appear in the Windows 11 benchmark word for word. When you're on a server, work the groups in the same order.
User rights that change on a server¶
A server has no everyday user sitting at the console. So a few rights that Windows 11 grants to Users or Remote Desktop Users are reduced to Administrators only. These override the Windows 11 values on the User Rights Assignment page.
| CIS | Right | Windows 11 | Server 2022 | Why |
|---|---|---|---|---|
| 2.2.2 | Access this computer from the network | Administrators, Remote Desktop Users | Administrators, Authenticated Users | A server serves; other machines' users must reach its shares and services, but only after they authenticate. Remove Everyone. |
| 2.2.5 | Allow log on locally | Administrators, Users | Administrators | Only administrators sit at a server console |
| 2.2.13 | Create symbolic links | Administrators | Administrators, plus NT VIRTUAL MACHINE\Virtual Machines if the Hyper-V role is installed |
|
| 2.2.19 | Deny log on through Remote Desktop Services | Guests, Local account | Guests | "Local account" is a domain-era entry; on a standalone server every account is local, so denying it would lock out RDP entirely |
| 2.2.22 | Generate security audits | LOCAL SERVICE, NETWORK SERVICE, RESTRICTED SERVICES\PrintSpoolerService |
LOCAL SERVICE, NETWORK SERVICE | The restricted spooler identity is a Windows 11 feature |
| 2.2.23 | Impersonate a client after authentication | Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE, RESTRICTED SERVICES\PrintSpoolerService |
Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE | Same |
| 2.2.35 | Shut down the system | Administrators, Users | Administrators | A user shutting down a server takes every service with it |
The remaining rights are identical. Notice the numbering shifts after 2.2.26 because the server benchmark leaves out the Level 2 "Log on as a batch job" and "Log on as a service" items; the right names are what you match on, not the numbers.
If the README lists a non-administrator who must sign in at the console, that person needs Allow log on locally. Add the individual account, not the Users group, and keep the reasoning: the smallest set that satisfies the README.
Remote Desktop settings only the server benchmark asks for¶
Both are in gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host.
| CIS | Subfolder | Setting | Value | Why |
|---|---|---|---|---|
| 18.10.57.3.2.1 | Connections | Restrict Remote Desktop Services users to a single Remote Desktop Services session | Enabled (Level 2) | One account, one session. A second session under the same name is either a mistake or someone else using the credential. |
| 18.10.57.3.11.2 | Temporary Folders | Do not use temporary folders per session | Disabled | Each session gets its own temp folder that's deleted at logoff, so one session can't read another's scratch files |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fSingleSessionPerUser /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v PerSessionTempDir /t REG_DWORD /d 1 /f
The rest of the Remote Desktop page applies unchanged.
Other server-specific details¶
Named pipes that can be accessed anonymously (2.3.10.6). Windows 11 wants this blank. The server benchmark says "configured" because some server roles legitimately need a pipe: a print server needs none on a modern OS, but a server hosting an old application might list one. On a standalone server with no such role, blank is still the right answer.
Print Spooler (5.1). The only service the server benchmark names; disabling it is Level 2, as on Windows 11. Every other service on the Services to Disable page is still worth disabling when the README doesn't need it; the server benchmark just doesn't enumerate them. Read the Print Spooler page either way.
Virtualization Based Security (18.9.5.x, 18.9.27.1). On Windows 11 these are Level 1. On the server benchmark they're in a separate "Next Generation Windows Security" profile because they need UEFI, Secure Boot, and a hypervisor-capable host. Set them if the VM lets you; a VMware image without those features will simply ignore the policy. The values are on the Credential Protection page.
BitLocker on a server¶
The CIS server benchmark has no BitLocker profile, but the server STIG requires encryption of data at rest (WN22-00-000250, CAT I), and the feature is one command away. Install it and follow the four BitLocker pages as written; the BitLocker: Basics page has the install step.
The server STIG¶
The CIS Windows Server 2022 STIG Benchmark v3.0.0 adds a layer on top of the standalone benchmark the same way the Windows 11 STIG does. Its 230 member-server items almost all restate CIS or Windows 11 STIG rows already on this site. The server-only items are folded into the pages where they belong and marked STIG WN22-…:
| Where | What the server STIG adds |
|---|---|
| Installed Programs | Roles and features to uninstall: Fax Server, FTP, PNRP, Simple TCP/IP, Telnet and TFTP clients, SMB1, PowerShell 2.0 |
| NTFS Basics, Registry Permissions | Default permissions on C:\, Program Files, Windows, and the HKLM hive must not have been loosened |
| Event Log | Permissions on all three main logs and on eventvwr.exe; a 192 MB Security log |
| IIS | FTP sites in IIS: no anonymous logon, no access to the system drive |
| Print Spooler | Standard users get Print permission only on shared printers |
| Remove and Create Accounts | One person, one account: no shared accounts, separate admin and everyday accounts |
| Credential Protection | Cached logons: 4 or fewer on a server |
| Telemetry | Turn off Inventory Collector |
The 44 domain-controller items (WN22-DC-…) are in the Active Directory group.
Pages that don't apply to a server¶
The server benchmark leaves out a set of Windows 11 items because the feature isn't part of Server 2022 or isn't meant for it. Skip these on a server image, and don't hunt for settings that aren't there.
| Windows 11 page or section | Why it's absent on Server 2022 |
|---|---|
| Application Guard | Not available on Server |
| Windows Sandbox settings on Attack Surface | Not available on Server |
| Xbox services, Game Recording, GameInput on Services to Disable | Not present on Server |
| Cortana, Recall, widgets, news and interests, Store, consumer experiences, OneDrive on the Privacy pages | Consumer features that Server doesn't ship or doesn't expose in policy |
| Enhanced Phishing Protection (18.10.77.1.x) on SmartScreen | Windows 11 only |
Standby states, sudo command, device setup class blocking, Windows protected print and IPP TLS rows |
Windows 11 only |
| The SMB authentication rate limiter and mailslot items on SMB | Newer than the server benchmark; harmless to set, but Server 2022 may not honor them |
If you set one of these on a server anyway, nothing breaks; it's a wasted minute. The point of the list is to know where not to spend time.
When Active Directory arrives¶
Later rounds add a domain. The Active Directory group covers it: what moves into the directory, the domain controller's own settings, what changes on a member server, Group Policy, and directory auditing and permissions. Until then, treat "Local account" and "Domain Admins" entries as things that shouldn't exist on a standalone box.