What changed in Active Directory Forest STIG V3R2V3R2 changes

Active Directory Forest STIG V3R2 (2025-07-02) replaced V3R1 (2024-09-13): 1 check updated. It has 7 checks, against 7 in V3R1.

V3R2 checklistV3R1 checklist Compare V3R1 and V3R2 in STIG Compare

  • 0 added
  • 0 removed
  • 1 updated

Updated fields: Check text 1

Updated in V3R2 (1)

V-269098CAT IWindows Server hosting Active Directory Certificate Services (AD CS) must enforce Certificate Authority (CA) certificate management approval for certificate requests.Check text

Check text

Certificate templates with the following extended key usages AND that allow a requestor to supply the subject name in the request must require manual approvaIapproval. In the AD CS web server properties, select "VulnerableCertTemplate" properties. Verify that "Subject Name" and "Supply in the request" are selected. If "Subject Name" andAND "Supply in the request" are selected and if manual approval is not required, this is a finding. If the "Supply in Request" is NOT selected, and the Enroll Permissions for the template have been limited to a select group of users/administrators, this is not a finding.

V-269098 in V3R2

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.