Microsoft Windows Server 2025 Security Technical Implementation Guide

The Microsoft Windows Server 2025 Security Technical Implementation Guide (V1 R4) has 291 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

291STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R4

CurrentPublished Wed Sep 30 2026

Windows Server 2025 must be configured to at least negotiate signing for LDAP client signing.

Microsoft Windows Server 2025 Security Technical Implementation Guide

Assessment Title

Rule Text

Windows Server 2025 must be configured to at least negotiate signing for LDAP client signing.

Description

Discussion Text

This setting controls the signing requirements for LDAP clients. This must be set to "Negotiate signing" or "Require signing", depending on the environment and type of LDAP server in use.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-278226

Rule

SV-278226r1268251_rule

Severity

medium

Rule Version

WN25-SO-000320

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE 
Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\

Value Name: LDAPClientIntegrity

Value Type: REG_DWORD
Value: 0x00000001 (1)

Implementation Procedure

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> Network security: LDAP client signing requirements to "Negotiate signing" at a minimum.

STIG check 238 of 291 in the Microsoft Windows Server 2025 STIG checklist

← Previous · V-278225Windows Server 2025 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM.Next · V-278227 →Windows Server 2025 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.