What changed in Microsoft Windows 10 SCAP Benchmark V3R7V3R7 changes

Microsoft Windows 10 SCAP Benchmark V3R7 (2025-11-24) replaced V3R6 (2025-09-24): 3 rules added, 1 removed, 2 updated. It has 225 rules, against 223 in V3R6.

V3R7 benchmarkV3R6 benchmark Compare V3R6 and V3R7 in SCAP Compare

  • 3 added
  • 1 removed
  • 2 updated

Updated fields: Check text 2CCIs 1Fix text 1Discussion 1

Added in V3R7 (3)

  • V-278924CAT IIWindows 10 must be configured to audit sensitive privilege use successes.
  • V-278925CAT IIWindows 10 must be configured to audit sensitive privilege use failures.
  • V-279687CAT IIWindows 10 systems must block consumer account user authentication.

Removed since V3R6 (1)

  • V-220908CAT IIThe built-in administrator account must be disabled.

Updated in V3R7 (2)

V-220706CAT IWindows 10 systems must be maintained at a supported servicing level.Check text, Fix text, CCIs

Check text

AND OR NOT AND - VerifiesThe theinstalled OSoperating Versionsystem isbelongs equal to orthe greaterMicrosoft thanWindows 6.3family registry_test family_test (check: all, existence: at_least_one_exists) object registry_objectfamily_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentVersion"; key equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" state registry_statefamily_state: typefamily equals "reg_szwindows"; value greater than or equal "6.3" - VerifiesThe theinstalled OSoperating Buildsystem is equalMicrosoft toWindows 10 or greater than 19045.0 but not equal to 19044.011 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentBuildNumberProductName"; key equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value greaterpattern thanmatch or equal "19045^[Ww][Ii][Nn][Dd][Oo][Ww][Ss] 1[01].0*$" AND - VerifyThe thecurrent OSbuild isnumber Windows 10 Enterprise LTSC registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "EditionId"; key equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value equals "EnterpriseS" - Verifies the OS Build is equalless to or greater than 1024022000. This forindicates Windows 10 Enterpriseis LTSCthe operating system. registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentBuildNumber"; key equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value greaterless than or equal "1024022000" Run "winver.exe". If the "About Windows" dialog box does not display a version supported by the vendor, this is a finding.

Fix text

UpdateUpgrade systems on the Semi-Annual Channel to "Microsofta Windowssupported Version 22H2 (OS Build 19045.x)" or greater. It is recommended systems be upgraded to the most recently released version. Special-purpose systemsof using the LTSC\Boperating may be at the following versions: v1507 (Build 10240) v1607 (Build 14393) v1809 (Build 17763) v21H2 (Build 19044)system.

CCIs

CCI-00033766

V-220706 in V3R7

V-220946CAT IIWindows 10 must use multifactor authentication for local and network access to privileged and nonprivileged accounts.Check text, Discussion

Check text

AND - oval:mil.disa.stig.win:tst:25347000 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals ""; key pattern match "SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\Readers\\\\\\S+" - oval:mil.disa.stig.win:tst:25347001 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals ""; key pattern match "SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\SmartCards\\\\\\S+" If the system is not a member of a domain, this is Not Applicable. If all of the following settings exist and are populated, this is not a finding. Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\Readers Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards

Discussion

Without the use of multifactor authentication, the ease of access to privileged and nonprivileged functions is greatly increased. All domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: 1) Something a user knows (e.g., password/PIN); 2) Something a user has (e.g., cryptographic identification device, token); and 3) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). Local access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. The DoDDOD CAC with DoDDOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055

V-220946 in V3R7

How these changes are found

Rules are matched across the two benchmark releases by their STIG V-number. A rule counts as updated when its rule id changed and its title, severity, discussion, fix text or OVAL check logic changed — the same comparison SCAP Compare makes.

Comparing other releases, or this one against an older release? Pick any two in SCAP Compare.