Microsoft Windows 11 Security Technical Implementation Guide

The Microsoft Windows 11 Security Technical Implementation Guide (V2 R11) has 257 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

257STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R11

CurrentPublished Wed Sep 30 2026

Internet Information System (IIS) or its subcomponents must not be installed on a workstation.

Microsoft Windows 11 Security Technical Implementation Guide

Assessment Title

Rule Text

Internet Information System (IIS) or its subcomponents must not be installed on a workstation.

Description

Discussion Text

IIS is not installed by default. Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted. Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-253275

Rule

SV-253275r958478_rule

Severity

high

Rule Version

WN11-00-000100

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify it has not been installed on the system.

Run "Programs and Features".
Select "Turn Windows features on or off".

If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, this is a finding.

If an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO. In addition, any applicable requirements from the IIS STIG must be addressed.

Implementation Procedure

Fix Text

Uninstall "Internet Information Services" or "Internet Information Services Hostable Web Core" from the system.

STIG check 20 of 257 in the Microsoft Windows 11 STIG checklist

← Previous · V-253274Permissions for system files and directories must conform to minimum requirements.Next · V-253276 →Simple Network Management Protocol (SNMP) must not be installed on the system.