What changed in Microsoft Windows Server 2022 STIG V2R11V2R11 changes

Title

Windows Server 2022 passwords for the built-in Administrator account must be changed at least every 6180 days.

Check text

If there are no enabled local Administrator accounts, this is Not Applicable. Review the password last set date for the enabled local Administrator account. On the stand alone or domain-joined server: Open "PowerShell". Enter "Get-LocalUser | Where-Object {$_.SID -like "*500"} | ForEach-Object ($_.PasswordLastSet){"$($_.Name) password is: $([int]((Get-Date) - $_.PasswordLastSet).TotalDays) days old"}". If the "PasswordLastSet" date is greater than "60180" days old for the local Administrator account for administering the computer, this is a finding. Verify LAPS is configured and operational. If the system is a stand alone member server, the LAPS portion of this requirement is Not Applicable. Navigate to Local Computer Policy >> Computer Configuration >> Administrative Templates >> System >> LAPS >> Password Settings >> Set to enabled. Password Complexity, large letters + small letters + numbers + special, Password Length 14, Password Age 60180. If not configured as shown, this is a finding. Verify LAPS Operational logs >> Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> LAPS >> Operational. Verify LAPS policy process is completing. If it is not, this is a finding.

Fix text

Change the enabled local Administrator account password at least every 60180 days. For domain-joined systems, Windows LAPS, must be used on domain-joined member servers to changeaccomplish this for the built-inbuiltin AdministratorAdmnistrator account. passwordThe AO still has the overall authority to use another equivalent capability to accomplish the check. More information is available at: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/by-popular-demand-windows-laps-available-now/ba-p/3788747 https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview#windows-laps-supported-platforms-and-azure-ad-laps-preview-status

V-254239 in V2R11

Check text

1. Determine the system's OS version: a. Open "Command Prompt". Enterb. Run "winver.exe". If theThe "About Windows" dialog box doeswill not display the system’s version and OS build. For example, "Microsoft Windows Server Version 21H121H2 (Build 20348.xxx5499)". or c. greaterRecord the numbers for the system. 2. Determine Microsoft's support stance for Windows 2022: As of this writing, the published guidance (at https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2022) states that Mainstream Support ends on 10/14/2026 and Extended Support ends on 10/15/2031. Visit the site to determine the latest support date guidance. 3. Determine Microsoft's latest available Windows 2022 OS version and Security Patch: a. Access Microsoft’s Lifecycle & Build History website at https://learn.microsoft.com/en-us/windows/release-health/windows-server-release-info. b. Review the Windows 2022 table (under heading of "Windows Server release history"). To view the table, expand heading of "Windows Server 2022 (OS build 20348)". c. Compare the system’s OS build and KB # with those listed to determine how many (if any) newer patches are available for the system’s OS version. It is strongly recommended that the latest security patch be installed, unless there is a valid operational reason to delay installing it. If the end-of-support date (which includes the "Extended End Date") for the system’s OS version is a past date, this is a finding. Note: Preview versions must not be used in a production environment.

Fix text

UpdateEnsure the system tois aat Version 21H2 (Build 20348.xxx) or greater. Determine if the end-of-support date for the system’s OS build is a past date. If the end-of-support date for the system’s OS build is in the past, perform an update to an OS build whose end-of-support date is a future date.

Discussion

Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates. For Windows Server 2022, Microsoft made the following statement at https://support.microsoft.com/en-us/servicing/os/windows-server/2026/08/kb5120242-windows-server-2022-security-update regarding ongoing OS support: "On October 13, 2026, Windows Server 2022 will reach end of mainstream support. The October 2026 security update will be the last mainstream support update available for this version. After this date, Windows Server 2022 will transition to extended support, which includes security updates at no additional cost, and will continue to receive monthly security updates through October 14, 2031." The Long-Term Servicing Channel (LTSC) remains the standard support branch for Enterprise server platforms. The guidance in this rule assumes usage via this support channel.

V-254247 in V2R11

Check text

The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN22-SO-000240). Review the permissions for the system drive's root directory (usually C:1). Nonprivileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. Individual accounts must not be used to assign permissions. If permissions are not as restrictive as the default permissions listed below, this is a finding. Viewing in File Explorer: 1. View the Properties of the system drive's root directory. 2. Select the "Security" tab, and thethen click "Advanced" button. Default permissions: C:1 Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to SYSTEM - Full control - This folder, subfolders, and files Administrators - Full control - This folder, subfolders, and files Users - Read & execute - This folder, subfolders, and files Users - Create folders/append data - This folder and subfolders (Note: "Authenticated Users" is acceptable) Users - Create files/write data - Subfolders only (Note: "Authenticated Users" is acceptable) CREATOR OWNER - Full Control - Subfolders and files only Alternately, use icacls: 1. Open "Command Prompt (Admin)". 2. Enter "icacls" followed by the directory: "icacls c:1" The following results must be displayed: c:1 NT AUTHORITY1SYSTEM:(OI)(CI)(F) BUILTIN1Administrators:(OI)(CI)(F) BUILTIN1Users:(OI)(CI)(RX) BUILTIN1Users:(CI)(AD) BUILTIN1Users:(CI)(IO)(WD) *NT AUTHORITY1Authenticated Users:(OI)(CI)(IO)(M) *NT AUTHORITY1Authenticated Users:(AD) CREATOR OWNER:(OI)(CI)(IO)(F) **Mandatory Label1High Mandatory Level:(OI)(NP)(IO)(NW) Successfully processed 1 files; Failed processing 0 files * - Some system's configurations managed via a CSP (e.g. via Azure) may display minor differences (more restrictive) for Users or Authenticated Users. ** - Mandatory Label is part of the system access control list (SACL) and may not display for some (nonstandard) implementations.

Fix text

Maintain the default permissions for the system drive's root directory and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN22-SO-000240). Default Permissions C:1 Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to SYSTEM - Full control - This folder, subfolders, and files Administrators - Full control - This folder, subfolders, and files Users - Read & execute - This folder, subfolders, and files Users - Create folders/append data - This folder and subfolders (or Authenticated Users) Users - Create files/write data - Subfolders only (or Authenticated Users) CREATOR OWNER - Full Control - Subfolders and files only

V-254251 in V2R11

Check text

Open "Windows PowerShell". Domain Controllers: Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. Member servers and standalone or nondomain-joined systems: Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.LastLogin.Value $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 if ($lastLogin -eq $null) { $lastLogin = 'Never' } Write-Host $user.Name $lastLogin $enabled }" This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). For example: User1 10/31/20152025 5:49:56 AM True Review the list of accounts returned by the above queries to determine the finding validity for each account reported. Exclude the following accounts: - Built-in administrator account (Renamed, SID ending in 500) - Built-in guest account (Renamed, Disabled, SID ending in 501) - Application accounts If any enabled accounts have not been logged on to within the past 35 days, this is a finding. Inactive accounts that have been reviewed and deemed to be required must be documented with the Information System Security Officer (ISSO).

CCIs

CCI-003627,CCI-000795CCI-000017

V-254256 in V2R11

Title

Windows Server 2022 maximum password age must be configured to 6180 days or less.

Check text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60180" days, this is a finding. If the value is set to "0" (never expires), this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:1Path1FileName.Txt If "MaximumPasswordAge" is greater than "60180" or equal to "0" in the file, this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> Maximum password age to "60180" days or less (excluding "0", which is unacceptable).

V-254289 in V2R11

Check text

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1PowerShell1Transcription1 Value Name: EnableTranscripting Value Type: REG_DWORD Value: 1 The location used for log storage must be a write-only, restricted directory (preferably a network share) that security personnel can access. The registry value setting for "Transcript output directory" is set by the GPO to "C:1ProgramData1PS_Transcript". That directory allows Read, Modify and Delete access by standard (non-privileged) user accounts. Either a different directory that has appropriate access permissions must be configured, or the permissions for the Transcript output directory must be configured appropriately. If the directory used to store the PowerShell transcription log files (Transcript output directory) permits read or modify access by non-privileged users, this is a finding. If the output directory set by the GPO is preferred, the access permissions must be revised to ensure the PowerShell Transcription log files are accessible only to Administrator and System accounts. To review permissions of the output directory, enter the following commands. Open "Command Prompt (Admin)". [Enter "icacls" followed by the directory configured to store PowerShell Transcription logs:] icacls C:1ProgramData1PS_Transcript If log files currently reside in the output directory, issue the following: icacls C:1ProgramData1PS_Transcript1*.* The results must be displayed as below: NT AUTHORITY1SYSTEM:(OI)(CI)(IO)(F) BUILTIN1Administrators:(OI)(CI)(IO)(F) *NT AUTHORITY1Authenticated Users:(OI)(CI)(WD,AD) *BUILTIN1Users:(OI)(CI)(WD,AD) *Note: The standard user accounts may differ based on the system's purpose/role and Active Directory structure. If the directory used to store PowerShell Transcription logs is not configured to provide Full Control access to Administrative and System accounts while permitting write-only access for standard user accounts, this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Transcription" to "Enabled". SpecifyIf a centralized (versus local) Transcript output directory is preferred, configure the Transcript output directory to point to a Central Log Server or another secure location to prevent user Read, Modify and Delete access by non-privileged accounts. Ensure the directory is write-only with Full Control access by Administrator and System accounts. Enter the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1PowerShell1Transcription *Value Name: OutputDirectory Value Type: REG_SZ (String Value) *Note: "OutputDirectory" value should be: "[Your custom directory path (e.g., I:1UserX_PowerShellTranscripts)]" If the folder configured (in the registry) as the Transcript output directory is not configured to provide Full Control access to Administrative and System accounts, while permitting WD, AD access for standard user accounts, Issue the following commands: Open "Command Prompt (Admin)". 1) If the directory configured to store PowerShell Transcription logs does not exist: mkdir C:1ProgramData1PS_Transcript 2) Assign appropriate permissions to Administrators group and System account: icacls "C:1ProgramData1PS_Transcript" /inheritance:r /grant:r "Administrators:(OI)(CI)(F)" /grant:r "SYSTEM":(OI)(CI)(F) 3) Assign appropriate permissions to user groups: icacls "C:1ProgramData1PS_Transcript" /grant:r "Users":(OI)(CI)(WD,AD) /t /c icacls "C:1ProgramData1PS_Transcript" /grant:r "Authenticated Users":(OI)(CI)(WD,AD) /t /c

V-254384 in V2R11

Check text

For domain controllers and standalone or nondomain-joined systems, this is NA. If the system is being used as an Exchange server, this requirement is not applicable. Open "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root1Microsoft1Windows1DeviceGuard" If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. Alternately: Run "System Information". Under "System Summary", verify the following: If "Device Guard Security Services Running" does not list "Credential Guard", this is a finding. The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1DeviceGuard1 Value Name: LsaCfgFlags Value Type: REG_DWORD Value: 0x00000001 (1) (Enabled with UEFI lock) A Microsoft article on Credential Guard system requirement can be found at the following link: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements

Fix text

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> Turn On Virtualization Based Security to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration". A Microsoft article on Credential Guard system requirement can be found at the following link: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements Severity Override Guidance: The AO can allow the severity override if they have reviewed the overall protection provided to the affected servers that are not capable of complying with the Credential Guard requirement. Items that must be reviewed/considered for compliance or mitigation for non-Credential Guard compliance are: The use of Microsoft Local Administrator Password Solution (LAPS) or similar products to control different local administrative passwords for all affected servers. This is to include a strict password change requirement (60180 days or less). .... Strict separation of roles and duties. Server administrator credentials cannot be used on Windows 10 desktop to administer it. Documentation of all exceptions must be supplied. .... Use of a Privileged Access Workstation (PAW) and adherence to the Clean Source principle for administering affected servers. .... Boundary Protection that is currently in place to protect from vulnerabilities in the network/servers. .... Windows Defender rule block credential stealing from LSASS.exe is applied. This rule can only be applied if Windows Defender is in use. .... The overall number of vulnerabilities that are unmitigated on the network/servers.

V-254441 in V2R11

Check text

Note: This Check must be performed for each interactive user profile on the system. The default behavior is for Windows to mark file attachments with their zone information. If the registry Value Name below does not exist, this is not a finding. If it exists and is configured with a value of "2", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_CURRENT_USER Registry Path: 1SOFTWARE1Microsoft1Windows1CurrentVersion1Policies1Attachments1 Value Name: SaveZoneInformation Value Type: REG_DWORD Value: 0x00000002 (2) (or if the Value Name does not exist) Note: This requirement is applicable to profiles for interactive logins. It is not applicable for Service accounts. To determine the system's enabled user profiles: Run "PowerShell" as an administrator. Execute the following command: Get-LocalUser | Where-Object {$_.Enabled -eq $true}

Fix text

The default behavior is for Windows to mark file attachments with their zone information. If this needs to be corrected, for each user profile on the system configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> Do not preserve zone information in file attachments to "Not Configured" or "Disabled".

V-254490 in V2R11