SV-279688r1256671: Windows 11 systems must block consumer account user authentication. | Microsoft Windows 11 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Windows 11 systems must block consumer account user authentication.

Description

Discussion Text

It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore, may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). The Copilot Rewrite functionality within Notepad and Image Generation within Paint is dependent upon the use of AI credits from a Microsoft 365 Personal or Family subscription. Organizational users must not use personal accounts to login to applications on enterprise machines.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000381

References

DPMS Target Microsoft Windows 11 DISA DPMS Target Microsoft Windows 11 5471

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.windows11:def:279688
# Windows 11 systems must block consumer account user authentication.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# registry_object (registry_test)
function test_1 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftAccount').GetValueKind('DisableUserAuth').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftAccount' -Name 'DisableUserAuth' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'DisableUserAuth') -eq 1))
}

if (test_1) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_11 target this check assesses.

# OVAL definition: oval:mil.disa.stig.windows11:def:279688
if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount\DisableUserAuth" -ErrorAction SilentlyContinue) -or (Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount" -Name DisableUserAuth -ErrorAction SilentlyContinue).DisableUserAuth -ne 1) {Write-Output "FAIL"; Exit 1} else {Write-Output "PASS"; Exit 0}

Remediation

Configure the following Group Policy:

Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Account "block all consumer Microsoft account user authentication" to "Enabled".

For systems managed by Intune, apply the DoW Windows 11 STIG Settings Catalog (or equivalent Intune policy) found in the Intune policy package available on cyber.mil.

Steps to create an Intune policy:

1. Sign in to the Intune admin center >> Devices >> Configuration >> Create >> New Policy.
2. Platform: Windows 10 and later. Profile type: Settings Catalog, then click "Create".
3. Basics: Provide a Name and Description of the profile, then click "Next".
4. Configuration settings: Click "+ Add settings" and search for consumer under the Settings picker. Under the Administrative Templates\Windows Components\Microsoft account category, check the box next to "Block all consumer Microsoft account user authentication". Click the Enabled radio button, then click "Next".
5. Scope tags: (optional), then click "Next".
6. Assignments: Assign the policy to Entra security groups that contain the target users or devices, then click "Next".
7. Review + create: Review the deployment summary, then click "Create".