What changed in Microsoft Windows 10 STIG V3R6V3R6 changes

Microsoft Windows 10 STIG V3R6 (2026-01-05) replaced V3R5 (2025-10-01): 1 check added, 2 removed, 3 updated. It has 267 checks, against 268 in V3R5.

V3R6 checklistV3R5 checklist Compare V3R5 and V3R6 in STIG Compare

  • 1 added
  • 2 removed
  • 3 updated

Updated fields: Check text 3Fix text 2CCIs 1Discussion 1

Added in V3R6 (1)

  • V-279687CAT IIWindows 10 systems must block consumer account user authentication.

Removed since V3R5 (2)

  • V-220735CAT IIBluetooth must be turned off when not in use.
  • V-220908CAT IIThe built-in administrator account must be disabled.

Updated in V3R6 (3)

V-220706CAT IWindows 10 systems must be maintained at a supported servicing level.Check text, Fix text, CCIs

Check text

Run "winver.exe". If the "About Windows" dialog box does not display the following or greater, this is a finding: "Microsoftversion Windowssupported Versionby 22H2 (OS Build 19045.x)" Note: Microsoft has extended support for previous versions, providing critical and important updates for Windows 10 Enterprise. Microsoft scheduled end-of-support dates for current Semi-Annual Channel versions: v22H2 - 14 Oct 2025 v21H2 - 13 Jun 2024 No preview versions will be used in a production environment. Special-purpose systems using the Long-Term Servicing Branch1Channel (LTSC1B) may be at the following versionsvendor, whichthis is not a finding: v1507 (Build 10240) v1607 (Build 14393) v1809 (Build 17763) v21H2 (Build 19044).

Fix text

UpdateUpgrade systems on the Semi-Annual Channel to "Microsofta Windowssupported Version 22H2 (OS Build 19045.x)" or greater. It is recommended systems be upgraded to the most recently released version. Special-purpose systemsof using the LTSC1Boperating may be at the following versions: v1507 (Build 10240) v1607 (Build 14393) v1809 (Build 17763) v21H2 (Build 19044)system.

CCIs

CCI-00033766

V-220706 in V3R6

V-220734CAT IIBluetooth must be turned off unless approved by the organization.Check text, Fix text

Check text

This is NA if the system does not have Bluetooth. Verify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Microsoft1PolicyManager1current1device1Connectivity1 Value Name: AllowBluetooth Value Type: REG_DWORD Value: 0x00000000 (0) Approval must be documented with the ISSO.

Fix text

Turn off Bluetooth radios not organizationally approved. For Establishsystems managed by Intune, apply the DOD Windows 10 STIG Settings Catalog (or equivalent Intune policy) found in the Intune policy package available on cyber.mil. Steps to create an organizationalIntune policy: 1. forSign in to the useIntune admin center >> Devices >> Configuration >> Create >> New Policy. 2. Platform: Windows 10 and later. Profile type: Settings Catalog, then click "Create". 3. Basics: Provide a Name and Description of the profile, then click "Next". 4. Configuration settings: Click "+ Add settings" and search for connectivity under the Settings picker. Under the Connectivity category, check the box next to Allow Bluetooth setting. Choose the first option, Disallow Bluetooth, then click "Next". 5. Scope tags: (optional), then click "Next". 6. Assignments: Assign the policy to Entra security groups that contain the target users or devices, then click "Next". 7. Review + create: Review the deployment summary, then click "Create".

V-220734 in V3R6

V-220946CAT IIWindows 10 must use multifactor authentication for local and network access to privileged and nonprivileged accounts.Check text, Discussion

Check text

If the system is not a member of a domain, this is Not Applicable. If oneall of the following settings does not exist and isare not populated, this is not a finding: . Computer1HKEY_LOCAL_MACHINE1SOFTWARE1Microsoft1Cryptography1Calais1Readers Computer1HKEY_LOCAL_MACHINE1SOFTWARE1Microsoft1Cryptography1Calais1SmartCards

Discussion

Without the use of multifactor authentication, the ease of access to privileged and nonprivileged functions is greatly increased. All domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: 1) Something a user knows (e.g., password/PIN); 2) Something a user has (e.g., cryptographic identification device, token); and 3) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). Local access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. The DoDDOD CAC with DoDDOD-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055

V-220946 in V3R6

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R6 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.