What changed in Microsoft Windows Server 2025 SCAP Benchmark V1R2V1R2 changes

Check text

AND - oval:mil.disa.stig.win:tst:25425000 wmi57_test (check: all, existence: none_exist) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT filesystem FROM win32_logicaldisk WHERE drivetype=3 AND filesystem!='NTFS' AND filesystem!='ReFS' AND filesystem!='CSVFS'" Open "Computer Management". Select "Disk Management" under "Storage". For each local volume, if the file system does not indicate "NTFS", this is a finding. "ReFS" (Resilient File System) is also acceptable and would not be a finding. "CSVFS" (Cluster Shared Volumes File Systems) is also acceptable and would not be a finding. This does not apply to system partitions such the Recovery and EFI System Partition.

V-277997 in V1R2

Title

Windows Server 2025 maximum password age must be configured to 6180 days or less.

Check text

AND - oval:mil.disa.stig.win:tst:25330100 passwordpolicy_test (check: all, existence: ) object passwordpolicy_object: state passwordpolicy_state: max_passwd_age less than or equal "518400015552000" state passwordpolicy_state: max_passwd_age greater than "0" Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt If "MaximumPasswordAge" is greater than "60" or equal to "0" in the file, this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. Set "Maximum password age" to "60180" days or less (excluding "0", which is unacceptable).

V-278037 in V1R2

Check text

AND OR - Audit - Logon - Success only auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: logon equals "AUDIT_SUCCESS" - Audit - Logon - Success and Failure auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: logon equals "AUDIT_SUCCESS_FAILURE" Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "AuditPol" tool to review the current Audit Policy configuration. Open PowerShell or a command prompt with elevated privileges ("Run as administrator"). Enter "AuditPol /get /category:*" Compare the "AuditPol" settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logon - Success

V-278059 in V1R2

Check text

AND OR - Audit - Logon - Failure only auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: logon equals "AUDIT_FAILURE" - Audit - Logon - Success and Failure auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: logon equals "AUDIT_SUCCESS_FAILURE" Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "AuditPol" tool to review the current Audit Policy configuration. Open PowerShell or a command prompt with elevated privileges ("Run as administrator"). Enter "AuditPol /get /category:*" Compare the "AuditPol" settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logon - Failure

V-278060 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25335300 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableIPSourceRouting"; key equals "System\\CurrentControlSet\\Services\\Tcpip6\\Parameters" state registry_state: type equals "reg_dword"; value equals "2" Verify the registry value below: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisableIPSourceRouting Type: REG_DWORD Value: 0x00000002 (2) If the registry value does not exist or is not configured as specified, this is a finding.

V-278082 in V1R2

Check text

AND - Verifies 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Highest protection, source routing is completely disabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableIPSourceRouting"; key equals "System\\CurrentControlSet\\Services\\Tcpip\\Parameters" state registry_state: type equals "reg_dword"; value equals "2" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: DisableIPSourceRouting Value Type: REG_DWORD Value: 0x00000002 (2)

V-278083 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25335500 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "EnableICMPRedirect"; key equals "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters" state registry_state: type equals "reg_dword"; value equals "0" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableICMPRedirect Value Type: REG_DWORD Value: 0x00000000 (0)

V-278084 in V1R2

Check text

AND - Verifies 'Enable insecure guest logons' is set to 'Disabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "AllowInsecureGuestAuth"; key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation" state registry_state: type equals "reg_dword"; value equals "0" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ Value Name: AllowInsecureGuestAuth Type: REG_DWORD Value: 0x00000000 (0)

V-278086 in V1R2

Check text

AND - Mutual Authentication and Integrity for \\*\SYSVOL registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "\\\\*\\SYSVOL"; key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths" state registry_state: type equals "reg_sz"; value pattern match "(^| *, *)RequireMutualAuthentication=1( *, *|$)" state registry_state: type equals "reg_sz"; value pattern match "(^|[ *, *])RequireMutualAuthentication=(?!1( *, *|$))" state registry_state: type equals "reg_sz"; value pattern match "(^| *, *)RequireIntegrity=1( *, *|$)" state registry_state: type equals "reg_sz"; value pattern match "(^| *, *)RequireIntegrity=(?!1( *, *|$))" - Mutual Authentication and Integrity for \\*\NETLOGON registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "\\\\*\\NETLOGON"; key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths" state registry_state: type equals "reg_sz"; value pattern match "(^| *, *)RequireMutualAuthentication=1( *, *|$)" state registry_state: type equals "reg_sz"; value pattern match "(^|[ *, *])RequireMutualAuthentication=(?!1( *, *|$))" state registry_state: type equals "reg_sz"; value pattern match "(^| *, *)RequireIntegrity=1( *, *|$)" state registry_state: type equals "reg_sz"; value pattern match "(^| *, *)RequireIntegrity=(?!1( *, *|$))" This requirement is applicable to domain-joined systems. For stand-alone or nondomain-joined systems, this is not applicable. If the following registry values do not exist or are not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ Value Name: \\*\NETLOGON Value Type: REG_SZ Value: RequireMutualAuthentication=1, RequireIntegrity=1 Value Name: \\*\SYSVOL Value Type: REG_SZ Value: RequireMutualAuthentication=1, RequireIntegrity=1 Additional entries would not be a finding.

V-278087 in V1R2

Check text

AND - Verifies 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "AllowProtectedCreds"; key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\CredentialsDelegation" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ Value Name: AllowProtectedCreds Type: REG_DWORD Value: 0x00000001 (1)

V-278089 in V1R2

Check text

AND - Verifies 'Boot-Start Driver Initialization Policy' is not set to 'Enabled' with 'All' selected registry_test (check: all, existence: any_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DriverLoadPolicy"; key equals "System\\CurrentControlSet\\Policies\\EarlyLaunch" state registry_state: type equals "reg_dword"; value equals "1" state registry_state: type equals "reg_dword"; value equals "3" state registry_state: type equals "reg_dword"; value equals "8" The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0x00000007 (7)", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\ Value Name: DriverLoadPolicy Value Type: REG_DWORD Value: 0x00000001 (1), 0x00000003 (3), or 0x00000008 (8) (or if the Value Name does not exist) Possible values for this setting are: 8 - Good only 1 - Good and unknown 3 - Good, unknown and bad but critical 7 - All (which includes "bad" and would be a finding)

V-278091 in V1R2

Check text

AND - NoGPOistChanges is set to 0. registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "NoGPOListChanges"; key equals "Software\\Policies\\Microsoft\\Windows\\Group Policy\\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" state registry_state: type equals "reg_dword"; value equals "0" This is not applicable for Domain Controllers. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ Value Name: NoGPOListChanges Type: REG_DWORD Value: 0x00000000 (0)

V-278092 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25338000 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DCSettingIndex"; key equals "SOFTWARE\\Policies\\Microsoft\\Power\\PowerSettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ Value Name: DCSettingIndex Type: REG_DWORD Value: 0x00000001 (1)

V-278096 in V1R2

Check text

AND - Verifies 'Require a password when a computer wakes (plugged in)' is set to 'Enabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "ACSettingIndex"; key equals "Software\\Policies\\Microsoft\\Power\\PowerSettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ Value Name: ACSettingIndex Type: REG_DWORD Value: 0x00000001 (1)

V-278097 in V1R2

Check text

AND - Verifies 'Allow Diagnostic Data' is set to 'Diagnostic Data Off (Not recommended)' or 'Send Required Diagnostic Data' selected in 'Options:' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "AllowTelemetry"; key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection" state registry_state: type equals "reg_dword"; value equals "0" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ Value Name: AllowTelemetry Type: REG_DWORD Value0x00000000 (0), 0x00000001 (1)

V-278103 in V1R2

Check text

AND - DODownloadMode==0,1,2,OR 99 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DODownloadMode"; key equals "Software\\Policies\\Microsoft\\Windows\\DeliveryOptimization" state registry_state: type equals "reg_dword"; value equals "0" state registry_state: type equals "reg_dword"; value equals "1" state registry_state: type equals "reg_dword"; value equals "2" state registry_state: type equals "reg_dword"; value equals "99" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ Value Name: DODownloadMode Value Type: REG_DWORD Value: 0x00000000 (0) - No peering (HTTP Only) 0x00000001 (1) - Peers on same NAT only (LAN) 0x00000002 (2) - Local Network / Private group peering (Group) 0x00000063 (99) - Simple download mode, no peering (Simple) 0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) A value of 0x00000003 (3), internet, is a finding.

V-278104 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25339700 registry_test (check: all, existence: any_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "NoHeapTerminationOnCorruption"; key equals "SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer" state registry_state: type equals "reg_dword"; value equals "0" The default behavior is for File Explorer heap termination on corruption to be enabled. If the registry Value Name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoHeapTerminationOnCorruption Value Type: REG_DWORD Value: 0x00000000 (0) (or if the Value Name does not exist)

V-278110 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25339800 registry_test (check: all, existence: any_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "PreXPSP2ShellProtocolBehavior"; key equals "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" state registry_state: type equals "reg_dword"; value equals "0" The default behavior is for shell protected mode to be turned on for File Explorer. If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: PreXPSP2ShellProtocolBehavior Value Type: REG_DWORD Value: 0x00000000 (0) (or if the Value Name does not exist)

V-278111 in V1R2

Check text

AND - Verifies 'Do not allow drive redirection' is set to 'Enabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "fDisableCdm"; key equals "Software\\Policies\\Microsoft\\Windows NT\\Terminal Services" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableCdm Type: REG_DWORD Value: 0x00000001 (1)

V-278113 in V1R2

Check text

AND - Verifies 'Require secure RPC communication' is set to 'Enabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "fEncryptRPCTraffic"; key equals "Software\\Policies\\Microsoft\\Windows NT\\Terminal Services" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fEncryptRPCTraffic Type: REG_DWORD Value: 0x00000001 (1)

V-278115 in V1R2

Check text

AND - Verifies 'Set client connection encryption level' is set to 'Enabled' and 'High Level' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "MinEncryptionLevel"; key equals "Software\\Policies\\Microsoft\\Windows NT\\Terminal Services" state registry_state: type equals "reg_dword"; value equals "3" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: MinEncryptionLevel Type: REG_DWORD Value: 0x00000003 (3)

V-278116 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25340700 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableEnclosureDownload"; key equals "SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ Value Name: DisableEnclosureDownload Type: REG_DWORD Value: 0x00000001 (1)

V-278117 in V1R2

Check text

AND - Verifies 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Not Configured' or 'Disabled' registry_test (check: all, existence: any_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "SafeForScripting"; key equals "Software\\Policies\\Microsoft\\Windows\\Installer" state registry_state: type equals "reg_dword"; value equals "0" The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: SafeForScripting Value Type: REG_DWORD Value: 0x00000000 (0) (or if the Value Name does not exist)

V-278122 in V1R2

Check text

AND - Verifies 'Domain Controllercontroller: LDAP Serverserver signing requirements Enforcement' is set to 'Require signingEnabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "LDAPServerIntegrityLDAPServerEnforceIntegrity"; key case insensitive equals "SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters" state registry_state: type equals "reg_dword"; value equals "21" This applies to domain controllers. It is not applicable for other systems. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\NTDS\Parameters\ Value Name: LDAPServerIntegrity Value Type: REG_DWORD Value: 0x00000002 (2)

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> Domain controller: LDAP server signing requirements Enforcement to "Not Configured" or "Enabled". Note: For the Windows Server 2025 security policy "Domain controller: LDAP server signing requirements Enforcement", configuring the setting to "Not Configured" (Default) or "Enabled" results in the same behavior.

V-278163 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25441700 registry_test (check: all, existence: ) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "RefusePasswordChange"; key case insensitive equals "SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters" state registry_state: type equals "reg_dword"; value equals "0" This applies to domain controllers. It is not applicable for other systems. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RefusePasswordChange Value Type: REG_DWORD Value: 0x00000000 (0)

V-278164 in V1R2

Check text

AND - Access this computer from the network - Administrators, Authenticated Users, Enterprise Domain Controllers userright_test (check: all, existence: ) object userright_object: userright equals "SE_NETWORK_LOGON_NAME" state userright_state: trustee_name equals "" state userright_state: trustee_name case insensitive equals "Administrators" state userright_state: trustee_name case insensitive equals "Authenticated Users" state userright_state: trustee_name case insensitive equals "Enterprise Domain Controllers" This applies to domain controllers. It is not applicable for other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Access this computer from the network" right, this is a finding: - Administrators. - Authenticated Users. - Enterprise Domain Controllers. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs other than the following are granted the "SeNetworkLogonRight" user right, this is a finding. S-1-5-32-544 (Administrators) S-1-5-11 (Authenticated Users) S-1-5-9 (Enterprise Domain Controllers) If an application requires this user right, this is not a finding. Vendor documentation must support the requirement for having the user right. The requirement must be documented with the information system security officer (ISSO). The application account must meet requirements for application account passwords, such as length (WN25-00-000050) and required frequency of changes (WN25-00-000060).

V-278165 in V1R2

Check text

AND - Allow log on through Remote Desktop Services - Administrators userright_test (check: all, existence: ) object userright_object: userright equals "SE_REMOTE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name equals "" state userright_state: trustee_name case insensitive equals "Administrators" This applies to domain controllers, it is not applicable for other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding: - Administrators. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs other than the following are granted the "SeRemoteInteractiveLogonRight" user right, this is a finding. S-1-5-32-544 (Administrators)

V-278167 in V1R2

Check text

AND - Deny access to this computer from the network - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_NETWORK_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: - Guests Group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyNetworkLogonRight" user right, this is a finding. S-1-5-32-546 (Guests)

V-278168 in V1R2

Check text

AND - Deny log on as a batch job - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_BATCH_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: - Guests Group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SID(s) are not defined for the "SeDenyBatchLogonRight" user right, this is a finding: S-1-5-32-546 (Guests)

V-278169 in V1R2

Check text

AND - Deny log on as a service - None userright_test (check: all, existence: ) object userright_object: userright equals "SE_DENY_SERVICE_LOGON_NAME" state userright_state: trustee_name equals "" This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups are defined for the "Deny log on as a service" user right, this is a finding. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs are granted the "SeDenyServiceLogonRight" user right, this is a finding.

V-278170 in V1R2

Check text

AND - Deny log on locally - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: - Guests Group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SID(s) are not defined for the "SeDenyInteractiveLogonRight" user right, this is a finding: S-1-5-32-546 (Guests)

V-278171 in V1R2

Check text

AND - UseStrongNameMatches == 1 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "UseStrongNameMatches"; key case insensitive equals "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\KDC\\Parameters" state registry_state: type equals "reg_dword"; value equals "1" This applies to domain controllers. This is not applicable for member servers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Administrative Template >> System >> KDC >> Allow name-based strong mappings for certificates. If "Allow name-based strong mappings for certificates" is not "Enabled", this is a finding.

V-278173 in V1R2

Check text

AND - Deny log on through Remote Desktop Services - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: - Guests Group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SID(s) are not defined for the "SeDenyRemoteInteractiveLogonRight" user right, this is a finding: S-1-5-32-546 (Guests)

V-278174 in V1R2

Check text

AND - 'Interactive logon: Number of previous logons to cache' is set to 4 or less registry_test (check: all, existence: at_least_one_exists) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "CachedLogonsCount"; key case insensitive equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" state registry_state: type equals "reg_sz"; value less than or equal "4" This applies to member servers. For domain controllers and stand-alone or nondomain-joined systems, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry HiveHKEY_LOCAL_MACHINE Registry Path\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value NameCachedLogonsCount Value TypeREG_SZ Value4 (or less)

V-278181 in V1R2

Check text

AND - Access this computer from the network - Administrators, Authenticated Users userright_test (check: all, existence: ) object userright_object: userright equals "SE_NETWORK_LOGON_NAME" state userright_state: trustee_name equals "" state userright_state: trustee_name case insensitive equals "Administrators" state userright_state: trustee_name case insensitive equals "Authenticated Users" This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Access this computer from the network" user right, this is a finding: - Administrators. - Authenticated Users. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs other than the following are granted the "SeNetworkLogonRight" user right, this is a finding: S-1-5-32-544 (Administrators) S-1-5-11 (Authenticated Users) If an application requires this user right, this is not a finding. Vendor documentation must support the requirement for having the user right. The requirement must be documented with the information system security officer (ISSO). The application account must meet requirements for application account passwords, such as length (WN25-00-000050) and required frequency of changes (WN25-00-000060).

V-278183 in V1R2

Check text

AND OR AND - oval:mil.disa.stig.win:tst:10000400 wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "3" - Deny access to this computer from the network - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_NETWORK_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" - Deny access to this computer from the network - Domain Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_NETWORK_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Domain Admins$" - Deny access to this computer from the network - Enterprise Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_NETWORK_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Enterprise Admins$" OR - Deny access to this computer from the network - Local account userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_NETWORK_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(NT Authority\\\\)?Local account$" - Deny access to this computer from the network - Local account and member of Administrators userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_NETWORK_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(NT Authority\\\\)?Local account and member of Administrators group$" AND - oval:mil.disa.stig.win:tst:10000300 wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "2" - Deny access to this computer from the network - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_NETWORK_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: Domain Systems Only: - Enterprise Admins group. - Domain Admins group. - "Local account and member of Administrators group" or "Local account" (see Note below). All Systems: - Guests group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyNetworkLogonRight" user right, this is a finding. Domain Systems Only: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) S-1-5-114 ("Local account and member of Administrators group") or S-1-5-113 ("Local account") All Systems: S-1-5-32-546 (Guests) Note: These are built-in security groups. "Local account" is more restrictive but may cause issues on servers such as systems that provide failover clustering.

V-278184 in V1R2

Check text

AND OR AND - oval:mil.disa.stig.win:tst:10000400 wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "3" - Deny log on as a batch job - Domain Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_BATCH_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Domain Admins$" - Deny log on as a batch job - Enterprise Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_BATCH_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Enterprise Admins$" - Deny log on as a batch job - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_BATCH_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" AND - oval:mil.disa.stig.win:tst:10000300 wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "2" - Deny log on as a batch job - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_BATCH_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: Domain Systems Only: - Enterprise Admins Group. - Domain Admins Group. All Systems: - Guests Group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyBatchLogonRight" user right, this is a finding. Domain Systems Only: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) All Systems: S-1-5-32-546 (Guests)

V-278185 in V1R2

Check text

AND - Deny log on as a service - Domain Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_SERVICE_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Domain Admins$" - Deny log on as a service - Enterprise Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_SERVICE_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Enterprise Admins$" This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on as a service" user right on domain-joined systems, this is a finding: - Enterprise Admins Group. - Domain Admins Group. If any accounts or groups are defined for the "Deny log on as a service" user right on nondomain-joined systems, this is a finding. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyServiceLogonRight" user right on domain-joined systems, this is a finding: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) If any SIDs are defined for the user right on nondomain-joined systems, this is a finding.

V-278186 in V1R2

Check text

AND OR AND - System is a member of a domain wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "1" state wmi57_state: result equals "3" - Deny log on locally - Domain Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Domain Admins$" - Deny log on locally - Enterprise Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Enterprise Admins$" - Deny log on locally - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" AND - System is not a member of a domain wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "0" state wmi57_state: result equals "2" - Deny log on locally - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: Domain Systems Only: - Enterprise Admins Group. - Domain Admins Group. All Systems: - Guests Group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyInteractiveLogonRight" user right, this is a finding: Domain Systems Only: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) All Systems: S-1-5-32-546 (Guests)

V-278187 in V1R2

Check text

AND OR AND - System is a member of a domain wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "1" state wmi57_state: result equals "3" - Deny log on through Remote Desktop Services - Local Account userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(NT Authority\\\\)?Local account$" - Deny log on through Remote Desktop Services - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" - Deny log on through Remote Desktop Services - Domain Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Domain Admins$" - Deny log on through Remote Desktop Services - Enterprise Admins userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name pattern match "^(?i)(.+\\\\)?Enterprise Admins$" AND - System is not a member of a domain wmi57_test (check: all, existence: ) object wmi57_object: namespace equals "root\\cimv2"; wql equals "SELECT DomainRole FROM win32_computersystem" state wmi57_state: result equals "0" state wmi57_state: result equals "2" - Deny log on through Remote Desktop Services - Guests userright_test (check: at least one, existence: ) object userright_object: userright equals "SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name case insensitive equals "Guests" This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: Domain Systems Only: - Enterprise Admins group. - Domain Admins group. - Local account (see Note below). All Systems: - Guests group. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyRemoteInteractiveLogonRight" user right, this is a finding. Domain Systems Only: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) S-1-5-113 ("Local account") All Systems: S-1-5-32-546 (Guests) Note: "Local account" refers to the Windows built-in security group.

V-278188 in V1R2

Check text

AND - Verifies 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "LimitBlankPasswordUse"; key equals "SYSTEM\\CurrentControlSet\\Control\\Lsa" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value Type: REG_DWORD Value: 0x00000001 (1)

V-278196 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25343500 sid_sid_test (check: all, existence: any_exist) object sid_sid_object: trustee_sid pattern match "^S-1-5-[0-9-]+-500$" state sid_sid_state: trustee_name case insensitive not equal "Administrator" state sid_sid_state: trustee_name case insensitive not equal "" This applies to member servers and stand-alone or nondomain-joined systems; it is not applicable for domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt If "NewAdministratorName" is not something other than "Administrator" in the file, this is a finding.

V-278197 in V1R2

Check text

AND - Verifies 'Accounts: Rename Guest account' is not set to 'Guest' or 'localdomain\Guest' sid_sid_test (check: all, existence: any_exist) object sid_sid_object: trustee_sid pattern match "^S-1-5-[0-9-]+-501$" state sid_sid_state: trustee_name case insensitive not equal "Guest" state sid_sid_state: trustee_name case insensitive not equal "" This applies to member servers and stand-alone or nondomain-joined systems; it is not applicable for domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt If "NewGuestName" is not something other than "Guest" in the file, this is a finding.

V-278198 in V1R2

Check text

AND - Audit policy using subcategories is enabled. registry_test (check: all, existence: at_least_one_exists) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "SCENoApplyLegacyAuditPolicy"; key case insensitive equals "SYSTEM\\CurrentControlSet\\Control\\Lsa" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: SCENoApplyLegacyAuditPolicy Value Type: REG_DWORD Value: 0x00000001 (1)

V-278199 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25344200 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "MaximumPasswordAge"; key equals "SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters" state registry_state: type equals "reg_dword"; value greater than "0" state registry_state: type equals "reg_dword"; value less than or equal "30" This applies to member servers and stand-alone or nondomain-joined systems; it is not applicable for domain controllers. This is the default configuration for this setting (30 days). If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: MaximumPasswordAge Value Type: REG_DWORD Value: 0x0000001e (30) (or less, but not 0)

V-278204 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25344800 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "SCRemoveOption"; key equals "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" state registry_state: type equals "reg_sz"; value equals "1" state registry_state: type equals "reg_sz"; value equals "2" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: scremoveoption Value Type: REG_SZ Value: 1 (Lock Workstation) or 2 (Force Logoff) If configuring this on servers causes issues, such as terminating users' remote sessions, and the organization has a policy in place that any other sessions on the servers, such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the information system security officer (ISSO).

V-278209 in V1R2

Check text

AND - 'Network access: Allow anonymous SID/Name translation' is set to 'Disabled' passwordpolicy_test (check: all, existence: ) object passwordpolicy_object: state passwordpolicy_state: anonymous_name_lookup equals "0" Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.

V-278215 in V1R2

Check text

AND - Verifies 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "RestrictAnonymousSAM"; key equals "System\\CurrentControlSet\\Control\\Lsa" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DWORD Value: 0x00000001 (1)

V-278216 in V1R2

Check text

AND - Verifies 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "restrictanonymous"; key equals "SYSTEM\\CurrentControlSet\\Control\\Lsa" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value Type: REG_DWORD Value: 0x00000001 (1)

V-278217 in V1R2

Check text

AND - Verifies 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "EveryoneIncludesAnonymous"; key equals "SYSTEM\\CurrentControlSet\\Control\\Lsa" state registry_state: type equals "reg_dword"; value equals "0" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: EveryoneIncludesAnonymous Value Type: REG_DWORD Value: 0x00000000 (0)

V-278218 in V1R2

Check text

AND - 'Network access: Restrict anonymous access to Named Pipes and Shares' is set to 'Enabled' registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "restrictnullsessaccess"; key equals "SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value Type: REG_DWORD Value: 0x00000001 (1)

V-278219 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25447000 registry_test (check: all, existence: ) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "UseMachineId"; key case insensitive equals "SYSTEM\\CurrentControlSet\\Control\\LSA" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\ Value Name: UseMachineId Type: REG_DWORD Value: 0x00000001 (1)

V-278220 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25345800 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "allownullsessionfallback"; key equals "SYSTEM\\CurrentControlSet\\Control\\LSA\\MSV1_0" state registry_state: type equals "reg_dword"; value equals "0" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ Value Name: allownullsessionfallback Type: REG_DWORD Value: 0x00000000 (0)

V-278221 in V1R2

Check text

AND - Verifies 'Network Security: Allow PKU2U authentication requests to this computer to use online identities' is set to 'Disabled' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "AllowOnlineID"; key equals "SYSTEM\\CurrentControlSet\\Control\\LSA\\pku2u" state registry_state: type equals "reg_dword"; value equals "0" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ Value Name: AllowOnlineID Type: REG_DWORD Value: 0x00000000 (0)

V-278222 in V1R2

Check text

AND - Verifies 'Network Security: Configure encryption types allowed for Kerberos' is set to 'Enabled' with 'AES128_HMAC_SHA1', 'AES256_HMAC_SHA1', 'Future encryption types' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "SupportedEncryptionTypes"; key equals "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters" state registry_state: type equals "reg_dword"; value equals "2147483640" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ Value Name: SupportedEncryptionTypes Value Type: REG_DWORD Value: 0x7ffffff8 (2147483640)

V-278223 in V1R2

Check text

AND - Verifies 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM' (Level 5) registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "LmCompatibilityLevel"; key equals "SYSTEM\\CurrentControlSet\\Control\\Lsa" state registry_state: type equals "reg_dword"; value equals "5" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value Type: REG_DWORD Value: 0x00000005 (5)

V-278225 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25346300 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "LDAPClientIntegrity"; key equals "SYSTEM\\CurrentControlSet\\Services\\LDAP" state registry_state: type equals "reg_dword"; value equals "1" state registry_state: type equals "reg_dword"; value equals "2" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ Value Name: LDAPClientIntegrity Value Type: REG_DWORD Value: 0x00000001 (1)

V-278226 in V1R2

Check text

AND - The system is configured to meet the minimum session security requirement for NTLM SSP based clients. registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "NTLMMinClientSec"; key equals "SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0" state registry_state: type equals "reg_dword"; value equals "537395200" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinClientSec Value Type: REG_DWORD Value: 0x20080000 (537395200)

V-278227 in V1R2

Check text

AND - Verifies 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers' is set to 'Require NTLMv2 session security' and 'Require 128-bit encryption' registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "NTLMMinServerSec"; key equals "SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0" state registry_state: type equals "reg_dword"; value equals "537395200" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinServerSec Value Type: REG_DWORD Value: 0x20080000 (537395200)

V-278228 in V1R2

Check text

AND - oval:mil.disa.stig.win:tst:25346700 registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "ProtectionMode"; key equals "SYSTEM\\CurrentControlSet\\Control\\Session Manager" state registry_state: type equals "reg_dword"; value equals "1" If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ Value Name: ProtectionMode Value Type: REG_DWORD Value: 0x00000001 (1)

V-278231 in V1R2

Check text

AND - 'Do not preserve zone information in file attachments' is set to 'Not Configured' or 'Disabled' ntuser_test (check: all, existence: any_exist) object ntuser_object: name equals "SaveZoneInformation"; filter equals "oval:mil.disa.stig.win:ste:20000027"; key equals "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments" state ntuser_state: type equals "reg_dword"; value equals "2" - For the current user, 'Do not preserve zone information in file attachments' is set to 'Not Configured' or 'Disabled' registry_test (check: all, existence: any_exist) object registry_object: hive equals "HKEY_CURRENT_USER"; name equals "SaveZoneInformation"; key equals "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments" state registry_state: type equals "reg_dword"; value equals "2" The default behavior is for Windows to mark file attachments with their zone information. If the registry Value Name below does not exist, this is not a finding. If it exists and is configured with a value of "2", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_CURRENT_USER Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ Value Name: SaveZoneInformation Value Type: REG_DWORD Value: 0x00000002 (2) (or if the Value Name does not exist)

Fix text

The default behavior is for Windows to mark file attachments with their zone information. To correct this, for each user profile on the system configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> Do not preserve zone information in file attachments to "Not Configured" or "Disabled".

V-278240 in V1R2

Check text

AND - Allow log on locally - Administrators userright_test (check: all, existence: ) object userright_object: userright equals "SE_INTERACTIVE_LOGON_NAME" state userright_state: trustee_name equals "" state userright_state: trustee_name case insensitive equals "Administrators" Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding: - Administrators. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs other than the following are granted the "SeInteractiveLogonRight" user right, this is a finding: S-1-5-32-544 (Administrators) If an application requires this user right, this is not a finding. Vendor documentation must support the requirement for having the user right. The requirement must be documented with the information system security officer (ISSO). The application account must meet requirements for application account passwords, such as length (WN25-00-000050) and required frequency of changes (WN25-00-000060).

V-278243 in V1R2

Check text

AND OR - Audit - Handle Manipulation - Failure only auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: handle_manipulation equals "AUDIT_FAILURE" - Audit - Handle Manipulation - Success and Failure auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: handle_manipulation equals "AUDIT_SUCCESS_FAILURE" Verify Audit Handle Manipulation auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Handle Manipulation. If "Audit Handle Manipulation" is not set to "Failure", this is a finding.

V-279918 in V1R2

Check text

AND OR - Audit - Registry - Failure only auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: registry equals "AUDIT_FAILURE" - Audit - Registry - Success and Failure auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: registry equals "AUDIT_SUCCESS_FAILURE" Verify Audit Registry auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Registry. If "Audit Registry" is not set to "Failure", this is a finding.

V-279920 in V1R2

Check text

AND OR - Audit - Registry - Success only auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: registry equals "AUDIT_SUCCESS" - Audit - Registry - Success and Failure auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: registry equals "AUDIT_SUCCESS_FAILURE" Verify Audit Registry auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Registry. If "Audit Registry" is not set to "Success", this is a finding.

V-279921 in V1R2

Check text

AND OR - Audit - Registry - Success only auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: sensitive_privilege_use equals "AUDIT_SUCCESS" - Audit - Registry - Success and Failure auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: sensitive_privilege_use equals "AUDIT_SUCCESS_FAILURE" Verify Audit Sensitive Privilege Use auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> Audit Sensitive Privilege Use. If "Audit Sensitive Privilege Use" is not set to "Success", this is a finding.

V-279922 in V1R2

Check text

AND OR - Audit - Sensitive Privilege Use - Failure only auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: sensitive_privilege_use equals "AUDIT_FAILURE" - Audit - Sensitive Privilege Use - Success and Failure auditeventpolicysubcategories_test (check: all, existence: at_least_one_exists) object auditeventpolicysubcategories_object: state auditeventpolicysubcategories_state: sensitive_privilege_use equals "AUDIT_SUCCESS_FAILURE" Verify Audit Sensitive Privilege Use auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> Audit Sensitive Privilege Use. If "Audit Sensitive Privilege Use" is not set to "Failure", this is a finding.

V-279923 in V1R2