CIS Benchmarks: Update Windows 11 to v5.0.1 (#45173)
Closes #39096
## Summary
Updates the CIS Windows 11 Enterprise benchmark policies from v4.0.0 to
v5.0.1.
### Phase 1 -- Title updates: 42 existing policy titles updated to match
v5.0.1
### Phase 2 -- New L1 policies: 17 added
New policies added:
- 18.5.2 MSS: DisableIPSourceRouting IPv6
- 18.5.3 MSS: DisableIPSourceRouting
- 18.6.7.3 Audit insecure guest logon (Lanman Server)
- 18.6.7.5 Enable remote mailslots (Lanman Server)
- 18.6.7.6 Mandate the minimum version of SMB (Lanman Server)
- 18.6.8.1 Audit insecure guest logon (Lanman Workstation)
- 18.6.8.5 Enable remote mailslots (Lanman Workstation)
- 18.6.8.6 Mandate the minimum version of SMB (Lanman Workstation)
- 18.6.21.1 Minimize simultaneous connections
- 18.6.21.2 Prohibit non-domain connections
- 18.6.23.2.1 Auto-connect to hotspots
- 18.7.5 Configure RPC listener settings (auth)
- 18.7.7 Configure RPC over TCP port
- 18.9.17.1 Enable/disable CLFS logfile authentication
- 18.10.73.1 Allow Recall to be enabled
- 18.11.1 Disable HTTP proxy features: Disable WPAD
- 18.11.2 Disable HTTP proxy features: Disable proxy authentication
### Additional fixes
- Fixed 16 policies where resolution text was inconsistent with policy
name/query
- Fixed YAML colon escaping for policy names containing colons (e.g.
"Domain member:", "Microsoft network client:")
- Added GP removal behavior note to README
- Validated with fleetctl apply (572 policies, no errors)
### Policy count: 572 (was 555)
---
## Testing
### Methodology
New policies tested on **Windows 11 Enterprise 24H2** VM
(DESKTOP-UUIQ1EM, build 10.0.26100.4349) via SSH + registry-direct
testing.
Three test cases per policy:
- PASS value -> query returns result
- FAIL value -> query returns empty
- NOT SET (deleted) -> query returns empty
### Results: All new policies pass
| # | CIS | Policy | Registry Key | FAIL | PASS |
|---|-----|--------|--------------|------|------|
| 1 | 18.9.17.1 | CLFS logfile authentication |
ClfsAuthenticationChecking=1 | PASS | PASS |
| 2 | 18.10.73.1 | Allow Recall to be enabled | AllowRecallEnablement=0
| PASS | PASS |
| 3 | 18.11.1 | Disable WPAD | DisableWpad=1 | PASS | PASS |
| 4 | 18.11.2 | Disable proxy authentication |
DisableProxyAuthenticationSchemes=256or287 | PASS | PASS |
### Import validation
fleetctl apply confirms all 572 policies parse and import successfully.
Test environment: Windows 11 Enterprise 24H2 (10.0.26100.4349), osqueryd
5.23.0 via fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Standardized many Windows 11 CIS policy names and UI text: explicit
principals (e.g., "No One"), expanded denial/user-right lists, and
normalized punctuation and prefixes (e.g., "Domain member:"). Renamed an
audit entry and aligned expected outcomes.
* **New Features**
* Added 30+ Windows CIS policies covering IP source routing protections,
SMB/Lanman guest and dialect controls, Network/WLAN hardening, RPC/print
mitigations, logfile/auth protections, Recall disablement, and
proxy/WPAD restrictions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45173)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sharon Katz
4c29a7aebc
