Microsoft Windows Server 2025 Security Technical Implementation Guide

The Microsoft Windows Server 2025 Security Technical Implementation Guide (V1 R4) has 291 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

291STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R4

CurrentPublished Wed Sep 30 2026

Windows Server 2025 Windows Remote Management (WinRM) service must not allow unencrypted traffic.

Microsoft Windows Server 2025 Security Technical Implementation Guide

Assessment Title

Rule Text

Windows Server 2025 Windows Remote Management (WinRM) service must not allow unencrypted traffic.

Description

Discussion Text

Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.

Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-278129

Rule

SV-278129r1181093_rule

Severity

medium

Rule Version

WN25-CC-000510

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\

Value Name: AllowUnencryptedTraffic

Type: REG_DWORD
Value: 0x00000000 (0)

Implementation Procedure

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> Allow unencrypted traffic to "Disabled".

STIG check 145 of 291 in the Microsoft Windows Server 2025 STIG checklist

← Previous · V-278128Windows Server 2025 Windows Remote Management (WinRM) service must not use Basic authentication.Next · V-278130 →Windows Server 2025 Windows Remote Management (WinRM) service must not store RunAs credentials.