What changed in Microsoft Windows Server 2016 SCAP Benchmark V2R8V2R8 changes

Microsoft Windows Server 2016 SCAP Benchmark V2R8 (2025-01-14) replaced V2R7 (2024-08-27): 1 rule added, 1 updated. It has 202 rules, against 201 in V2R7.

V2R8 benchmarkV2R7 benchmark Compare V2R7 and V2R8 in SCAP Compare

  • 1 added
  • 0 removed
  • 1 updated

Updated fields: Check text 1Fix text 1Discussion 1

Added in V2R8 (1)

  • V-271430CAT IWindows Server 2016 must be configured for name-based strong mappings for certificates.

Updated in V2R8 (1)

V-224828CAT ISystems must be maintained at a supported servicing level.Check text, Fix text, Discussion

Check text

AND - VerifiesThe theinstalled OSoperating Majorsystem Version is equalnot to or greater than 10 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentMajorVersionNumber"; key equals "Software\\Microsoft\\Windows NT\\CurrentVersion" stateServer registry_state: type equals "reg_dword"; value greater than or equal "10"2016 - Verifies the OS Build (currentNumber) is equal to or greater than 14393 registry_test (check: all,none existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentBuildNumber"; key equals "Software\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value greater than or equal "14393" - Verifies the OS Release is equal to or greater than 1607 registry_test (check: allsatisfy, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "ReleaseIdProductName"; key equals "SoftwareSOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value greaterpattern thanmatch or equal "1607" - Verifies the OS Build ^(current?i) is equal to or greater than 14393 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentBuild"; key equals "Software\\Microsoft\\Windows NT\\CurrentVersion" stateServer registry_state: type equals 2016.*$"reg_sz"; value greater than or equal "14393" Open "Command Prompt". Enter "winver.exe". If the "About Windows" dialog box does not display "Microsoft Windows Server Version 1607 (Build 14393.xxx)" or greater, this is a finding. Preview versions must not be used in a production environment.

Fix text

Update the system to a Version 1607 (Build 14393.xxx) or greater.Upgrade the operating system to a supported version.

Discussion

Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leaveleaves them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates.

V-224828 in V2R8

How these changes are found

Rules are matched across the two benchmark releases by their STIG V-number. A rule counts as updated when its rule id changed and its title, severity, discussion, fix text or OVAL check logic changed — the same comparison SCAP Compare makes.

Comparing other releases, or this one against an older release? Pick any two in SCAP Compare.