What changed in Microsoft Windows 11 STIG V2R11V2R11 changes

Title

Windows 11 systems must be maintained at a supported servicing level.

Check text

1. Determine your Windows 11 OS version. a. Run "winver.exe". IfThe the "About Windows" dialog box doeswill not display the system's version and OS build. For example, "Microsoft Windows 11 Version 22H224H2 (OS Build 2262126100.3808875)". Record the numbers observed. 2. Determine the system's latest installed security patch. a. Open "PowerShell" with elevated privileges (run as administrator). b. Enter the following: Get-HotFix -Description "Security Update" c. Record the "InstalledOn" date and the KB numbers listed under the "HotFixID" column in the resulting display. 3. Determine Microsoft's Support timeframe for the system's Windows 11 OS version. a. Access Microsoft's Lifecycle & Build History website at https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information. b. Review the table listing the "Windows 11 current versions by servicing option" to find the end-of-support date corresponding to the system's OS version. This date marks the official deadline after which Microsoft stops providing software support (or greatersecurity updates) for that operating system version. The Windows 11 current versions are categorized by servicing option. For example, (as of Aug 2026) under the General Availability Channel for Enterprise version 25H, the last date for (support) updates is 2028-10-10, and the latest build is 26200.9168. Similar data is provided for the Enterprise LTSC releases. c. Review (on the same page) a table listing "Windows 11 release history" data for OS hotpatch updates. Compare the system's OS build and KB # (from step 1 and 2) with those listed to determine how many (if any) newer patches are available for the system's OS version. It is strongly recommended that the latest security patch be installed, unless there is a valid operational reason to delay installing it. If the end-of-support date for the system's OS version (from step 3b) is a past date, this is a finding.

Fix text

UpdateDetermine systemsif on the Semiend-Annualof-support Channeldate tofor "the system's OS build (from Microsoft's Windows 11 Versionrelease 22H2history (OSwebsite) Buildis 22621a past date.380)" or If greaterthe end-of-support date for the system's OS build is in the past, perform an update to an OS build whose end-of-support date is a future date.

Discussion

Windows 11 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation. NewThe versionstype withof featureservicing updateschannel areused plannedwill todetermine bethe releasedfrequency onof aOS semi-annualupdates basisand withlength anof estimated support. timeframeUnder ofthe 18General toAvailability 30Channel months(GAC), dependingMicrosoft onreleases theone release.major Supportfeature forupdate previouslyper releasedyear versions(typically hasin beenthe extendedsecond forhalf Enterpriseof editionsthe calendar year, e. Ag., separateVersion servicing24H2). branchFor intendedWindows for11 specialEnterprise, purposeeach systemsannual isGAC therelease receives 36 months of support. The Long-Term Servicing Channel (LTSC) is designed for highly regulated, formerlyair-gapped, Branchor mission-critical LTSB)military/tactical whichenvironments. willMicrosoft receivereleases securitya updatesnew forLTSC 10version approximately every 2 to 3 years. butWindows excludes11 Enterprise LTSC receives five years of lifecycle support (quality and security updates only; no feature updates). Many Microsoft software updates and fixes are regularly combined into a single package (called a service pack) that is made available for installation. Both the Mainstream Support and Extended Support phases for software require a product's supported service pack to be installed to continue to receive full support. Microsoft publishes specific support timelines for a previous service pack when the new service pack is released. Systems must install a fully supported service pack to ensure they are on the latest and most secure version of their product.

V-253263 in V2R11

Check text

Verify an organizationally approved antivirus solution (Microsoft Defender Antivirus, for example) is installed on the system and in use. Verify if Microsoft Defender Antivirus is in use or enabled: If Windows Defender is your primary or secondary antivirus (AV) application, this command will use the built-in Microsoft Defender module to retrieve granular engine data. Open Run "PowerShell" as an administrator. EnterExecute "getthe following command: Get-serviceMpComputerStatus | whereSelect-Object {$_AMRunningMode, RealTimeProtectionEnabled, AntivirusEnabled, AMEngineVersion Review the resulting display.DisplayName Note the text under "AMRunningMode". This reveals how Defender is coexisting with other AV software. "Normal" indicates Defender is active and acting as the primary AV software. "Passive" indicates another compatible third-Likeparty AV software is registered and active. Defender can still provide auxiliary scanning. "*EDR Block Mode" indicates Defender* is executing in Passive Mode along with a third-party AV to actively block and remediate malicious files if the primary AV misses them. Review the text under heading of "}RealTimeProtectionEnabled". |A Selectvalue Status,DisplayNameof "True" or "False" indicates whether (or not) Defender is active (currently running). Verify third-party antivirus is in use or enabled: Note: This command will display all AV applications registered with the Windows Security Center (including third-party applications). Open Run "PowerShell" as an administrator. EnterExecute "getthe following command: Get-serviceCimInstance -Namespace root1SecurityCenter2 -ClassName AntiVirusProduct | whereSelect-Object {$_displayName, productState, pathToSignedProductExe Review the resulting display.DisplayName -LikeNote the text under "*mcafee*displayName"}. |This Selectwill Status,DisplayNameindicate the currently running AV applications. The "productState" returns an integer value that reveals whether the AV is active, disabled, or up-to-date. EnterThe value of "get397568" indicates it is active and up-serviceto-date. The |value whereof {$_"397584 indicates it is active, but out of date (signature updates required).DisplayName The -Likevalue of "*symantec*393472"} |indicates Selectdisabled Statusand up-to-date (AV installed,DisplayName but not active). The value of "393488" indicates disabled and out of date. If there is no antivirus solution installed and active on the system, this is a finding.

Fix text

Install and activate Microsoft Defender Antivirus or a third-party antivirus solution.

V-253264 in V2R11

Check text

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. If local users other than the accounts listed below exist on a workstation in a domain, this is a finding. The accounts listed assumes a system is joined to a domain and thus (per best practice), the local default accounts have been disabled. For standalone or nondomain-joined systems, this is Not Applicable. Built-in administrator account (Disabled, SID ending in 500) Built-in guest account (Disabled, SID ending in 501) Built-in DefaultAccount (Disabled, SID ending in 503) Built-in defaultuser0 (Disabled, *SID unique per workstation) Built-in WDAGUtilityAccount (Disabled, SID ending in 504) Local administrator account(s) * Note: thatThe the SID for defaultuser0 is machine-specific and immutable (cannot be changed). It will differ per Windows installation. AllSome of the built-in accounts may not exist on a system, depending on the Windows 11 version. Refer to WN11-SO-000280 for requirement/guidance in use of Windows LAPS to manage the built-in administrator account password.

V-253272 in V2R11

Check text

This is NA if the system does not have Bluetooth. Verify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Microsoft1PolicyManager1current1device1Connectivity1 Value Name: AllowBluetooth Value Type: REG_DWORD Value: 0x00000000 (0) Approval for Bluetooth use must be documented with the information system security officer (ISSO).

Fix text

Turn off Bluetooth radios not organizationally approved. For systems managed by Intune, apply the DODDoW Windows 11 STIG Settings Catalog (or equivalent Intune policy) found in the Intune policy package available on cyber.mil. Steps to create an Intune policy: 1. Sign in to the Intune admin center >> Devices >> Configuration >> Create >> New Policy. 2. Platform: Windows 10 and later. Profile type: Settings Catalog, then click "Create". 3. Basics: Provide a Name and Description of the profile, then click "Next". 4. Configuration settings: Click "+ Add settings" and search for connectivity under the Settings picker. Under the Connectivity category, check the box next to "Allow Bluetooth setting". Choose the first option, "Disallow Bluetooth", then click "Next". 5. Scope tags: (optional), then click "Next". 6. Assignments: Assign the policy to Entra security groups that contain the target users or devices, then click "Next". 7. Review + create: Review the deployment summary, then click "Create".

V-253291 in V2R11

Title

The maximum password age must be configured to 6180 days or less.

Check text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60180" days, this is a finding. If the value is set to "0" (never expires), this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum Password Age" to "60180" days or less (excluding "0" which is unacceptable).

V-253301 in V2R11

Check text

This is NA for Windows 11 LTSC. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1GameDVR1 (For GPO-managed systems) Or Registry Path: 1SOFTWARE1Microsoft1PolicyManager1current1device1ApplicationManagement (For Intune-managed systems) Value Name: AllowGameDVR Type: REG_DWORD Value: 0x00000000 (0)

Fix text

For GPO-managed systems: Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Game Recording and Broadcasting >> "Enables or disables Windows Game Recording and Broadcasting" to "Disabled". For Intune-managed systems: Revise the Intune policy to disable Windows Game Recording and Broadcasting.

Discussion

Windows Game Recording and Broadcasting is intended for use with games; however, it could record screenshots of other applications and expose sensitive data. Disabling the feature will prevent this from occurring. Note: A different registry location is needed when systems are managed by Intune versus GPO.

V-253399 in V2R11

Check text

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1PowerShell1Transcription1 Value Name: EnableTranscripting Value Type: REG_DWORD Value: 1 The location used for log storage must be a write-only, restricted directory (preferably a network share) that security personnel can access. The registry value setting for "Transcript output directory" is set by the GPO to "C:1ProgramData1PS_Transcript". That directory allows Read, Modify, and Delete access by standard (nonprivileged) user accounts. Either a different directory that has appropriate access permissions must be configured (see Fix text), or the permissions for the existing Transcript output directory must be configured appropriately. If the directory used to store the PowerShell transcription log files (Transcript output directory) permits read or modify access by nonprivileged users, this is a finding. If the output directory set by the GPO is preferred, the access permissions must be revised to ensure the PowerShell Transcription log files are accessible only to the Administrator and System accounts. To review permissions of the output directory, enter the following commands. Open "Command Prompt (Admin)". [Enter "icacls" followed by the directory configured to store PowerShell Transcription logs:] icacls C:1ProgramData1PS_Transcript If log files currently reside in the output directory, issue the following: icacls C:1ProgramData1PS_Transcript1*.* The results must be displayed as below: NT AUTHORITY1SYSTEM:(OI)(CI)(IO)(F) BUILTIN1Administrators:(OI)(CI)(IO)(F) *NT AUTHORITY1Authenticated Users:(OI)(CI)(WD,AD) *BUILTIN1Users:(OI)(CI)(WD,AD) *Note: The standard user accounts may differ based on the system's purpose/role and Active Directory structure. If the directory used to store PowerShell Transcription logs is not configured to provide Full Control access to Administrative and System accounts while permitting write-only access for standard user accounts, this is a finding.

Fix text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Transcription" to "Enabled". SpecifyIf a centralized (versus local) Transcript output directory is preferred, configure the Transcript output directory to point to a Central Log Server or another secure location to prevent user Read, Modify, and Delete access by nonprivileged accounts. Ensure the selected directory is write-only with Full Control access granted to Administrator and System accounts. Enter the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1PowerShell1Transcription *Value Name: OutputDirectory Value Type: REG_SZ (String Value) * Note: "OutputDirectory" value should be: "[custom directory path (e.g., I:1UserX_PowerShellTranscripts)]" If the folder configured (in the registry) as the Transcript output directory is not configured to provide Full Control access to Administrative and System accounts, while permitting WD, AD access for standard user accounts, issue the following commands: Open "Command Prompt (Admin)". 1. If the directory configured to store PowerShell Transcription logs does not exist: mkdir C:1ProgramData1PS_Transcript 2. Assign appropriate permissions to Administrators group and System account: icacls "C:1ProgramData1PS_Transcript" /inheritance:r /grant:r "Administrators:(OI)(CI)(F)" /grant:r "SYSTEM":(OI)(CI)(F) 3. Assign appropriate permissions to user groups: icacls "C:1ProgramData1PS_Transcript" /grant:r "Users":(OI)(CI)(WD,AD) /t /c icacls "C:1ProgramData1PS_Transcript" /grant:r "Authenticated Users":(OI)(CI)(WD,AD) /t /c

V-253415 in V2R11

Check text

The setting is NA when the "Allow voice activation" policy is configured to disallow applications to be activated with voice for all users. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1AppPrivacy1 Value Name: LetAppsActivateWithVoiceLetAppsActivateWithVoiceAboveLock Type: REG_DWORD Value: 0x00000002 (2)

Fix text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice while the system is locked" to "Enabled" with Default for all Apps: set to "Force Deny". The requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice" is configured to "Enabled" with Default for all Apps: set to Force Deny.

V-253422 in V2R11

Check text

Note: This Check must be performed for each interactive user profile on the system. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1CloudContent1 Value Name: DisableThirdPartySuggestions Type: REG_DWORD Value: 0x00000001 (1) Note: This requirement is applicable to profiles for interactive logins. It is not applicable for Service accounts. To determine the system's enabled user profiles: Run "PowerShell" as an administrator. Execute the following command: Get-LocalUser | Where-Object {$_.Enabled -eq $true}

Fix text

ConfigureFor each user profile on the system, configure the policy value for User Configuration >> Administrative Templates. >> Windows Components >> Cloud Content >> "Do not suggest third-party content in Windows spotlight" to "Enabled".

V-253425 in V2R11

Title

Passwords for enabled local Administrator accounts must be changed at least every 6180 days.

Check text

If there are no enabled local Administrator accounts, this is Not Applicable. Use of an enabled built-in account without management by LAPS must be documented and supplied to the information system security manager (ISSM)/information system security officer (ISSO) for their risk acceptance. An alternative process to LAPS is acceptable if it is documented and produces evidence that passwords for Administrator accounts are changed at least every 60180 days. Review the password last set date for the enabled local Administrator account. On the standalone or domain-joined workstation: Open "PowerShell". Enter "Get-LocalUser -Name * | Select-Object *". If the "PasswordLastSet" date is greater than "60180" days old for the local Administrator account for administering the computer/domain, this is a finding. Verify LAPS is configured and operational. Navigate to Local Computer Policy >> Computer Configuration >> Administrative Templates >> System >> LAPS >> Password Settings >> Set to enabled. Password Complexity, large letters + small letters + numbers + special, Password Length 14, Password Age 60180. If not configured as shown, this is a finding. Verify LAPS Operational logs >> Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> LAPS >> Operational. Verify LAPS policy process is completing. If it is not, this is a finding.

Fix text

Change the enabled local Administrator account password at least every 60180 days. Windows LAPS must be used to change the built-in Administrator account password. Domain-joined and nondomain-joined systems can configure this to occur more frequently. LAPS will change the password every 30 days by default. Operational limitations preventing the use of LAPS must be approved by the AO. More information is available at: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/by-popular-demand-windows-laps-available-now/ba-p/3788747 https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview#windows-laps-supported-platforms-and-azure-ad-laps-preview-status

V-253476 in V2R11

Check text

Note: This Check must be performed for each interactive user profile on the system. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1CurrentVersion1PushNotifications1 Value Name: NoToastApplicationNotificationOnLockScreen Value Type: REG_DWORD Value: 1 Note: This requirement is applicable to profiles for interactive logins. It is not applicable for Service accounts. To determine the system's enabled user profiles: Run "PowerShell" as an administrator. Execute the following command: Get-LocalUser | Where-Object {$_.Enabled -eq $true}

Fix text

ConfigureFor each user profile on the system, configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> "Turn off toast notifications on the lock screen" to "Enabled".

V-253477 in V2R11

Check text

Note: This Check must be performed for each interactive user profile on the system. The default behavior is for Windows to mark file attachments with their zone information. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_CURRENT_USER Registry Path: 1SOFTWARE1Microsoft1Windows1CurrentVersion1Policies1Attachments1 Value Name: SaveZoneInformation Value Type: REG_DWORD Value: 0x00000002 (2) (or if the Value Name does not exist) Note: This requirement is applicable to profiles for interactive logins. It is not applicable for Service accounts. To determine the system's enabled user profiles: Run "PowerShell" as an administrator. Execute the following command: Get-LocalUser | Where-Object {$_.Enabled -eq $true}

Fix text

The default behavior is for Windows to mark file attachments with their zone information. To correct this, (for each user profile on the system) configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> "Do not preserve zone information in file attachments" to "Not Configured" or "Disabled".

V-253478 in V2R11

Fix text

Open PowerShell as an administrator. Run the following commandcommands: Get-AppxPackage -AllUsers *CoPilot* | Remove-AppxPackage -AllUsers Get-AppxPackage -AllUsers -Name "Microsoft.Windows.Ai.Copilot.Provider" | Remove-AppxPackage -AllUsers Get-AppxProvisionedPackage -Online | Where-Object {$_.DisplayName -like "*Copilot*"} | Remove-AppxProvisionedPackage -Online Note: Major Windows feature updates may reprovision default AppX packages. Running the PowerShell commands in a script as a post-update task or deploying it via a startup script is highly recommended for persistent environments.

V-268317 in V2R11