What changed in Microsoft Windows Server 2025 STIG V1R4V1R4 changes

Title

Windows Server 2025 passwords for the built-in Administrator account must be changed at least every 6180 days.

Check text

If there are no enabled local Administrator accounts, this is not applicable. Review the password last set date for the enabled local Administrator account. On the stand-alonestandalone or domain-joined server: Open PowerShell. Enter "Get-LocalUser | Where-Object {$_.SID -like "*500"} | ForEach-Object ($_.PasswordLastSet){"$($_.Name) password is: $([int]((Get-Date) - $_.PasswordLastSet).TotalDays) days old"}". If the "PasswordLastSet" date is greater than "60180" days old for the local Administrator account for administering the computer, this is a finding. Verify Windows LAPS is configured and operational. If the system is a stand-alonestandalone member server, the LAPS portion of this requirement is not applicable. Navigate to Local Computer Policy >> Computer Configuration >> Administrative Templates >> System >> LAPS >> Password Settings >> Set to enabled. Password Complexity, large letters + small letters + numbers + special, Password Length 14, Password Age 60180. If not configured as shown, this is a finding. Navigate to LAPS Operational logs >> Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> LAPS >> Operational. Verify LAPS policy process is completing. If it is not, this is a finding.

Fix text

Change the built-in Administrator account password at least every 60180 days. ItWindows isLAPS highlymust recommendedbe used to usechange Microsoft'sthe LAPS,built-in whichAdministrator mayaccount bepassword. usedDomain-joined onand domainnondomain-joined membersystems serverscan configure this to accomplishoccur thismore frequently. LAPS will change the password every 30 days by default. Operational limitations preventing the use of LAPS must be approved by the AO. The AO still has the overall authority to use another equivalent capability to accomplish the check.

Discussion

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The built-in Administrator account is not generally used and its password may not be changed as frequently as necessary. Changing the password for the built-in Administrator account on a regular basis will limit its exposure. It is highly recommended to use Microsoft'sWindows Local Administrator Password Solution (LAPS). Domain-joined systems can configure this to occur more frequently. LAPS will change the password every 30 days by default. The authorizing official (AO) still has the overall authority to use another equivalent capability to accomplish the check.

V-277986 in V1R4

Check text

The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN25-SO-000240). Review the permissions for the system drive's root directory (usually C:1). Nonprivileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. Individual accounts must not be used to assign permissions. If permissions are not as restrictive as the default permissions listed below, this is a finding. Viewing in File Explorer: View the Properties of the system drive's root directory. Select the "Security" tab, and then click "Advanced". Default permissions: C:1 Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to SYSTEM - Full control - This folder, subfolders, and files Administrators - Full control - This folder, subfolders, and files Users - Read & execute - This folder, subfolders, and files Users - Create folders/append data - This folder and subfolders (Note: "Authenticated Users" is acceptable) Users - Create files/write data - Subfolders only (Note: "Authenticated Users" is acceptable) CREATOR OWNER - Full Control - Subfolders and files only Alternately, use icacls: 1. Open "commandCommand promptPrompt (Admin)". 2. Enter "icacls" followed by the directory: "icacls c:1" The following results must be displayed: c:1 NT AUTHORITY1SYSTEM:(OI)(CI)(F) BUILTIN1Administrators:(OI)(CI)(F) BUILTIN1Users:(OI)(CI)(RX) BUILTIN1Users:(CI)(AD) BUILTIN1Users:(CI)(IO)(WD) *NT AUTHORITY1Authenticated Users:(OI)(CI)(IO)(M) *NT AUTHORITY1Authenticated Users:(AD) CREATOR OWNER:(OI)(CI)(IO)(F) **Mandatory Label1High Mandatory Level:(OI)(NP)(IO)(NW) Successfully processed 1 files; Failed processing 0 files * - Some system's configurations managed via a CSP (e.g. via Azure) may display minor differences (more restrictive) for Users or Authenticated Users. ** - Mandatory Label is part of the system access control list (SACL) and may not display for some (nonstandard) implementations.

Fix text

Maintain the default permissions for the system drive's root directory and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN25-SO-000240). Default Permissions C:1 Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to SYSTEM - Full control - This folder, subfolders, and files Administrators - Full control - This folder, subfolders, and files Users - Read & execute - This folder, subfolders, and files (or Authenticated Users) Users - Create folders/append data - This folder and subfolders (or Authenticated Users) Users - Create files/write data - Subfolders only CREATOR OWNER - Full Control - Subfolders and files only

V-277998 in V1R4

Check text

Open Windows PowerShell. Domain Controllers: Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00". This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. Member servers and stand-alonestandalone or nondomain-joined systems: Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required.)  ([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.LastLogin.Value $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 if ($lastLogin -eq $null) { $lastLogin = 'Never' } Write-Host $user.Name $lastLogin $enabled } This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). For example: User1 10/31/20152025 5:49:56 AM True Review the list of accounts returned by the above queries to determine the finding validity for each account reported. Exclude the following accounts: - Built-in administrator account (Renamed, SID ending in 500). - Built-in guest account (Renamed, Disabled, SID ending in 501). - Application accounts. If any enabled accounts have not been logged on to within the past 35 days, this is a finding. Inactive accounts that have been reviewed and deemed to be required must be documented with the information system security officer (ISSO).

CCIs

CCI-003627,CCI-003628CCI-000017

V-278003 in V1R4

Title

Windows Server 2025 maximum password age must be configured to 6180 days or less.

Check text

Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60180" days, this is a finding. If the value is set to "0" (never expires), this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:1Path1FileName.Txt If "MaximumPasswordAge" is greater than "60180" or equal to "0" in the file, this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. Set "Maximum password age" to "60180" days or less (excluding "0", which is unacceptable).

V-278037 in V1R4

Check text

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1PowerShell1Transcription1 Value Name: EnableTranscripting Value Type: REG_DWORD Value: 1 The location used for log storage must be a write-only, restricted directory (preferably a network share) that security personnel can access. The registry value setting for "Transcript output directory" is set by the GPO to "C:1ProgramData1PS_Transcript". That directory allows Read, Modify, and Delete access by standard (nonprivileged) user accounts. Either a different directory that has appropriate access permissions must be configured, or the permissions for the Transcript output directory must be configured appropriately. If the directory used to store the PowerShell transcription log files (Transcript output directory) permits read or modify access by nonprivileged users, this is a finding. If the output directory set by the GPO is preferred, the access permissions must be revised to ensure the PowerShell Transcription log files are accessible only to Administrator and System accounts. To review permissions of the output directory, enter the following commands. Open "Command Prompt (Admin)". [Enter "icacls" followed by the directory configured to store PowerShell Transcription logs:] icacls C:1ProgramData1PS_Transcript If log files currently reside in the output directory, issue the following: icacls C:1ProgramData1PS_Transcript1*.* The results must be displayed as below: NT AUTHORITY1SYSTEM:(OI)(CI)(IO)(F) BUILTIN1Administrators:(OI)(CI)(IO)(F) *NT AUTHORITY1Authenticated Users:(OI)(CI)(WD,AD) *BUILTIN1Users:(OI)(CI)(WD,AD) *Note: The standard user accounts may differ based on the system's purpose/role and Active Directory structure. If the directory used to store PowerShell Transcription logs is not configured to provide Full Control access to Administrative and System accounts while permitting write-only access for standard user accounts, this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Transcription" to "Enabled". SpecifyIf a centralized (versus local) Transcript output directory is preferred, configure the Transcript output directory to point to a Central Log Server or another secure location to prevent user Read, Modify, and Delete access by nonprivileged accounts. Ensure the directory is write-only with Full Control access by Administrator and System accounts. Enter the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1PowerShell1Transcription *Value Name: OutputDirectory Value Type: REG_SZ (String Value) *Note: "OutputDirectory" value should be: "[Your custom directory path (e.g., I:1UserX_PowerShellTranscripts)]" If the folder configured (in the registry) as the Transcript output directory is not configured to provide Full Control access to Administrative and System accounts, while permitting WD, AD access for standard user accounts, issue the following commands: Open "Command Prompt (Admin)". 1. If the directory configured to store PowerShell Transcription logs does not exist: mkdir C:1ProgramData1PS_Transcript 2. Assign appropriate permissions to Administrators group and System account: icacls "C:1ProgramData1PS_Transcript" /inheritance:r /grant:r "Administrators:(OI)(CI)(F)" /grant:r "SYSTEM":(OI)(CI)(F) 3. Assign appropriate permissions to user groups: icacls "C:1ProgramData1PS_Transcript" /grant:r "Users":(OI)(CI)(WD,AD) /t /c icacls "C:1ProgramData1PS_Transcript" /grant:r "Authenticated Users":(OI)(CI)(WD,AD) /t /c

V-278131 in V1R4

Check text

This applies to domain controllers. It is not applicable for other systems. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SYSTEM1CurrentControlSet1Services1NTDS1Parameters1 Value Name: LDAPServerIntegrityLDAPServerEnforceIntegrity Value Type: REG_DWORD Value: 0x000000020x00000001 (21) Note: This LDAPServerEnforceIntegrity registry key explicitly overrides the legacy LDAPServerIntegrity key used in Windows Server 2022 and older. If this enforcement key is present and enabled, LDAP signing is strictly required regardless of the older policy setting.

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> Domain controller: LDAP server signing requirements Enforcement to "Not Configured" or "Enabled". Note: For the Windows Server 2025 security policy "Domain controller: LDAP server signing requirements Enforcement", configuring the setting to "Not Configured" (Default) or "Enabled" results in the same behavior.

V-278163 in V1R4

Check text

For domain controllers and stand-alonestandalone or nondomain-joined systems, this is not applicable. If the system is being used as an Exchange server, this requirement is not applicable. Open PowerShell with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root1Microsoft1Windows1DeviceGuard" If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. Alternately: Run "System Information". Under "System Summary", verify the following: If "Device Guard Security Services Running" does not list "Credential Guard", this is a finding. The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1DeviceGuard1 Value Name: LsaCfgFlags Value Type: REG_DWORD Value: 0x00000001 (1) (Enabled with UEFI lock) A Microsoft article on Credential Guard system requirements can be found at the following link: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements

Fix text

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> Turn On Virtualization Based Security to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration". A Microsoft article on Credential Guard system requirements can be found at the following link: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements Severity Override Guidance: The AO can allow the severity override if they have reviewed the overall protection provided to the affected servers that are not capable of complying with the Credential Guard requirement. Items that must be reviewed/considered for compliance or mitigation for non-Credential Guard compliance are: - The use of MicrosoftWindows Local Administrator Password Solution (LAPS) or similar products to control different local administrative passwords for all affected servers. This is to include a strict password change requirement (60180 days or less). - Strict separation of roles and duties. Server administrator credentials cannot be used on Windows desktop to administer it. Documentation of all exceptions must be supplied. - Use of a Privileged Access Workstation (PAW) and adherence to the Clean Source principle for administering affected servers. - Boundary Protection that is currently in place to protect from vulnerabilities in the network/servers. - Windows Defender rule block credential stealing from LSASS.exe is applied. This rule can only be applied if Windows Defender is in use. - The overall number of vulnerabilities that are unmitigated on the network/servers.

V-278190 in V1R4

Check text

Note: This Check must be performed for each interactive user profile on the system. The default behavior is for Windows to mark file attachments with their zone information. If the registry Value Name below does not exist, this is not a finding. If it exists and is configured with a value of "2", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_CURRENT_USER Registry Path: 1SOFTWARE1Microsoft1Windows1CurrentVersion1Policies1Attachments1 Value Name: SaveZoneInformation Value Type: REG_DWORD Value: 0x00000002 (2) (or if the Value Name does not exist) Note: This requirement is applicable to profiles for interactive logins. It is not applicable for Service accounts. To determine the system's enabled user profiles: Run "PowerShell" as an administrator. Execute the following command: Get-LocalUser | Where-Object {$_.Enabled -eq $true}

Fix text

The default behavior is for Windows to mark file attachments with their zone information. To correct this, for each user profile on the system configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> Do not preserve zone information in file attachments to "Not Configured" or "Disabled".

V-278240 in V1R4