Microsoft Windows 11 Security Technical Implementation Guide

The Microsoft Windows 11 Security Technical Implementation Guide (V2 R11) has 257 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

257STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R11

CurrentPublished Wed Sep 30 2026

The Secondary Logon service must be disabled on Windows 11.

Microsoft Windows 11 Security Technical Implementation Guide

Assessment Title

Rule Text

The Secondary Logon service must be disabled on Windows 11.

Description

Discussion Text

The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges. Using privileged credentials in a standard user session can expose those credentials to theft.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-253289

Rule

SV-253289r958478_rule

Severity

medium

Rule Version

WN11-00-000175

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Run "Services.msc".

Locate the "Secondary Logon" service.

If the "Startup Type" is not "Disabled" or the "Status" is "Running", this is a finding.

Implementation Procedure

Fix Text

Configure the "Secondary Logon" service "Startup Type" to "Disabled".

STIG check 33 of 257 in the Microsoft Windows 11 STIG checklist

← Previous · V-253288The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.Next · V-253290 →Orphaned security identifiers (SIDs) must be removed from user rights on Windows 11.