Microsoft Windows Server 2022 STIG

Microsoft Windows Server 2022 Security Technical Implementation Guide

The Microsoft Windows Server 2022 Security Technical Implementation Guide (V2 R11) has 277 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

277STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R11

CurrentPublished Wed Sep 30 2026

Windows Server 2022 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.

Microsoft Windows Server 2022 Security Technical Implementation Guide

Assessment Title

Rule Text

Windows Server 2022 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.

Description

Discussion Text

The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-254254

Rule

SV-254254r1210473_rule

Severity

medium

Rule Version

WN22-00-000170

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below.

If any nonprivileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding.

If permissions are not as restrictive as the default permissions listed below, this is a finding:

Note: "Authenticated Users" is default on Domain Controllers, and "Users" is default on member servers and stand-alone servers. Revise expected response based on the system context.

Run "Regedit".

Right-click on the registry areas noted below.

Select "Permissions" and "Advanced".

HKEY_LOCAL_MACHINE\SECURITY

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
SYSTEM - Full Control - This key and subkeys
Administrators - Special - This key and subkeys

HKEY_LOCAL_MACHINE\SOFTWARE

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
Users - Read - This key and subkeys
Administrators - Full Control - This key and subkeys
SYSTEM - Full Control - This key and subkeys
CREATOR OWNER - Full Control - This key and subkeys
ALL APPLICATION PACKAGES - Read - This key and subkeys

HKEY_LOCAL_MACHINE\SYSTEM

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
Authenticated Users - Read - This key and subkeys
Administrators - Full Control - This key and subkeys
SYSTEM - Full Control - This key and subkeys
CREATOR OWNER - Full Control - This key and Subkeys
ALL APPLICATION PACKAGES - Read - This key and subkeys
Server Operators - Read - This Key and subkeys (Domain controllers only)

Other examples under the noted keys may also be sampled. There may be some instances in which nonprivileged groups have greater than Read permission.

Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2022 to the following SID. This is currently not a finding.
S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681

If the defaults have not been changed, these are not a finding.

Implementation Procedure

Fix Text

Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive.

The default permissions of the higher-level keys are noted below.

Note: "Authenticated Users" is default on Domain Controllers, and "Users" is default on member servers and stand-alone servers. Revise expected response based on the system context.

HKEY_LOCAL_MACHINE\SECURITY

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
SYSTEM - Full Control - This key and subkeys
Administrators - Special - This key and subkeys

HKEY_LOCAL_MACHINE\SOFTWARE

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
Users - Read - This key and subkeys
Administrators - Full Control - This key and subkeys
SYSTEM - Full Control - This key and subkeys
CREATOR OWNER - Full Control - This key and subkeys
ALL APPLICATION PACKAGES - Read - This key and subkeys

HKEY_LOCAL_MACHINE\SYSTEM

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
Authenticated Users - Read - This key and subkeys
Administrators - Full Control - This key and subkeys
SYSTEM - Full Control - This key and subkeys
CREATOR OWNER - Full Control - This key and subkeys
ALL APPLICATION PACKAGES - Read - This key and subkeys
Server Operators - Read - This Key and subkeys (Domain controllers only)

Microsoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2022 to the following SID:
S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681

STIG check 17 of 277 in the Microsoft Windows Server 2022 STIG checklist

← Previous · V-254253Windows Server 2022 permissions for the Windows installation directory must conform to minimum requirements.Next · V-254255 →Windows Server 2022 nonadministrative accounts or groups must only have print permissions on printer shares.