What changed in Microsoft Windows Server 2022 SCAP Benchmark V2R11V2R11 changes

Check text

AND - Verifies the OS Version is equal to or greater than 6.3 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentVersion"; key equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value greater than or equal "6.3" - Verifies the OS Build is equal to or greater than 20348 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "CurrentBuildNumber"; key equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value greater than or equal "20348" Open "Command Prompt". Enter "winver.exe". If the "About Windows" dialog box does not display "Microsoft Windows Server Version 21H1 (Build 20348.xxx)" or greater, this is a finding. Preview versions must not be used in a production environment.

Fix text

UpdateEnsure the system tois aat Version 21H2 (Build 20348.xxx) or greater. Determine if the end-of-support date for the system’s OS build is a past date. If the end-of-support date for the system’s OS build is in the past, perform an update to an OS build whose end-of-support date is a future date.

Discussion

Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates. For Windows Server 2022, Microsoft made the following statement at https://support.microsoft.com/en-us/servicing/os/windows-server/2026/08/kb5120242-windows-server-2022-security-update regarding ongoing OS support: "On October 13, 2026, Windows Server 2022 will reach end of mainstream support. The October 2026 security update will be the last mainstream support update available for this version. After this date, Windows Server 2022 will transition to extended support, which includes security updates at no additional cost, and will continue to receive monthly security updates through October 14, 2031." The Long-Term Servicing Channel (LTSC) remains the standard support branch for Enterprise server platforms. The guidance in this rule assumes usage via this support channel.

V-254247 in V2R11

Title

Windows Server 2022 maximum password age must be configured to 6180 days or less.

Check text

AND - oval:mil.disa.stig.win:tst:25330100 passwordpolicy_test (check: all, existence: ) object passwordpolicy_object: state passwordpolicy_state: max_passwd_age less than or equal "518400015552000" state passwordpolicy_state: max_passwd_age greater than "0" Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt If "MaximumPasswordAge" is greater than "60" or equal to "0" in the file, this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> Maximum password age to "60180" days or less (excluding "0", which is unacceptable).

V-254289 in V2R11

Check text

AND - 'Do not preserve zone information in file attachments' is set to 'Not Configured' or 'Disabled' ntuser_test (check: all, existence: any_exist) object ntuser_object: name equals "SaveZoneInformation"; filter equals "oval:mil.disa.stig.win:ste:20000027"; key equals "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments" state ntuser_state: type equals "reg_dword"; value equals "2" - For the current user, 'Do not preserve zone information in file attachments' is set to 'Not Configured' or 'Disabled' registry_test (check: all, existence: any_exist) object registry_object: hive equals "HKEY_CURRENT_USER"; name equals "SaveZoneInformation"; key equals "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments" state registry_state: type equals "reg_dword"; value equals "2" The default behavior is for Windows to mark file attachments with their zone information. If the registry Value Name below does not exist, this is not a finding. If it exists and is configured with a value of "2", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_CURRENT_USER Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ Value Name: SaveZoneInformation Value Type: REG_DWORD Value: 0x00000002 (2) (or if the Value Name does not exist)

Fix text

The default behavior is for Windows to mark file attachments with their zone information. If this needs to be corrected, for each user profile on the system configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> Do not preserve zone information in file attachments to "Not Configured" or "Disabled".

V-254490 in V2R11