What changed in Microsoft Windows 11 SCAP Benchmark V2R11V2R11 changes

Fix text

UpdateDetermine systemsif on the Semiend-Annualof-support Channeldate tofor "the system's OS build (from Microsoft's Windows 11 Versionrelease 22H2history (OSwebsite) Buildis 22621a past date.380)" or If greaterthe end-of-support date for the system's OS build is in the past, perform an update to an OS build whose end-of-support date is a future date.

Discussion

Windows 11 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation. NewThe versionstype withof featureservicing updateschannel areused plannedwill todetermine bethe releasedfrequency onof aOS semi-annualupdates basisand withlength anof estimated support. timeframeUnder ofthe 18General toAvailability 30Channel months(GAC), dependingMicrosoft onreleases theone release.major Supportfeature forupdate previouslyper releasedyear versions(typically hasin beenthe extendedsecond forhalf Enterpriseof editionsthe calendar year, e. Ag., separateVersion servicing24H2). branchFor intendedWindows for11 specialEnterprise, purposeeach systemsannual isGAC therelease receives 36 months of support. The Long-Term Servicing Channel (LTSC) is designed for highly regulated, formerlyair-gapped, Branchor mission-critical LTSB)military/tactical whichenvironments. willMicrosoft receivereleases securitya updatesnew forLTSC 10version approximately every 2 to 3 years. butWindows excludes11 Enterprise LTSC receives five years of lifecycle support (quality and security updates only; no feature updates). Many Microsoft software updates and fixes are regularly combined into a single package (called a service pack) that is made available for installation. Both the Mainstream Support and Extended Support phases for software require a product's supported service pack to be installed to continue to receive full support. Microsoft publishes specific support timelines for a previous service pack when the new service pack is released. Systems must install a fully supported service pack to ensure they are on the latest and most secure version of their product.

V-253263 in V2R11

Title

The maximum password age must be configured to 6180 days or less.

Check text

AND - oval:mil.disa.stig.win:tst:25330100 passwordpolicy_test (check: all, existence: ) object passwordpolicy_object: state passwordpolicy_state: max_passwd_age less than or equal "518400015552000" state passwordpolicy_state: max_passwd_age greater than "0"

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum Password Age" to "60180" days or less (excluding "0" which is unacceptable).

V-253301 in V2R11

Fix text

For GPO-managed systems: Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Game Recording and Broadcasting >> "Enables or disables Windows Game Recording and Broadcasting" to "Disabled". For Intune-managed systems: Revise the Intune policy to disable Windows Game Recording and Broadcasting.

Discussion

Windows Game Recording and Broadcasting is intended for use with games; however, it could record screenshots of other applications and expose sensitive data. Disabling the feature will prevent this from occurring. Note: A different registry location is needed when systems are managed by Intune versus GPO.

V-253399 in V2R11

Check text

AND OR - oval:mil.disa.stig.win:tst:2534220025342201 registry_test (check: all, existence: ) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name equalscase "LetAppsActivateWithVoice";insensitive key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacyLetAppsActivateWithVoiceAboveLock" state registry_state: type equals "reg_dword"; valuekey equalscase "2" -insensitive oval:mil.disa.stig.win:tst:25342201 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "LetAppsActivateWithVoiceAboveLock"; key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy" state registry_state: type equals "reg_dword"; value equals "2"

Fix text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice while the system is locked" to "Enabled" with Default for all Apps: set to Force Deny. The requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice" is configured to "Enabled" with Default for all Apps: set to Force Deny".

V-253422 in V2R11

Fix text

ConfigureFor each user profile on the system, configure the policy value for User Configuration >> Administrative Templates. >> Windows Components >> Cloud Content >> "Do not suggest third-party content in Windows spotlight" to "Enabled".

V-253425 in V2R11

Fix text

ConfigureFor each user profile on the system, configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> "Turn off toast notifications on the lock screen" to "Enabled".

V-253477 in V2R11

Fix text

The default behavior is for Windows to mark file attachments with their zone information. To correct this, (for each user profile on the system) configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> "Do not preserve zone information in file attachments" to "Not Configured" or "Disabled".

V-253478 in V2R11