What changed in Windows 10 STIG V2R3V2R3 changes

Title

Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSSESS is used; 30 days, for any additional internal network scans not covered by HBSSESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).

Discussion

An approved tool for continuous network scanning must be installed and configured to run. Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. To support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSSESS and periodic scanning using other tools, as specified in the requirement.

V-220701 in V2R3

Check text

Verify an anti-virus solution is installed on the system and in use. The anti-virus solution may be bundled with an approved host-basedEndpoint securitySecurity solutionSolution. Verify if Windows Defender is in use or enabled: Open "PowerShell". Enter "get-service | where {$_.DisplayName -Like "*Defender*"} | Select Status,DisplayName" Verify third-party antivirus is in use or enabled: Open "PowerShell". Enter "get-service | where {$_.DisplayName -Like "*mcafee*"} | Select Status,DisplayName" Enter "get-service | where {$_.DisplayName -Like "*symantec*"} | Select Status,DisplayName" If there is no anti-virus solution installed on the system, this is a finding.

Fix text

If no anti-virus software is on the system and in use, install Windows Defender or a third-party anti-virus solution.

V-220707 in V2R3

Check text

Different methods are available to disable SMBv1 on Windows 10. This is the preferred method, however if V-74723220730 and V-74725220731 are configured, this is NA. Run "Windows PowerShell" with elevated privileges (run as administrator). Enter the following: Get-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol If "State : Enabled" is returned, this is a finding. Alternately: Search for "Features". Select "Turn Windows features on or off". If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding.

V-220729 in V2R3

Check text

Different methods are available to disable SMBv1 on Windows 10, if V-70639220729 is configured, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SYSTEM1CurrentControlSet1Services1LanmanServer1Parameters1 Value Name: SMB1 Type: REG_DWORD Value: 0x00000000 (0)

V-220730 in V2R3

Check text

Different methods are available to disable SMBv1 on Windows 10, if V-70639220729 is configured, this is NA. If the following registry value is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SYSTEM1CurrentControlSet1Services1mrxsmb101 Value Name: Start Type: REG_DWORD Value: 0x00000004 (4)

V-220731 in V2R3

Check text

This setting requires v1709 or later of Windows 10; it is NA for prior versions. If "Enhanced" level is enabled for telemetry, this must be configured. If "Security" or "Basic" are configured, this is NA. (See V-220922220834). If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: 1SOFTWARE1Policies1Microsoft1Windows1DataCollection1 Value Name: LimitEnhancedDiagnosticDataWindowsAnalytics Type: REG_DWORD Value: 0x00000001 (1)

V-220833 in V2R3

Fix text

For non-domain joined systems, configuring Windows Hello for sign on options would be suggested based on the organizations needs and capabilities. Note: Before applying, the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.

V-220946 in V2R3

Check text

Review the password last set date for the enabled local Administrator account. On the local domain joined workstation: Open "PowerShell". Enter "Get-LocalUser –Name * | Select-Object *" If the "PasswordLastSet" date is greater than "60" days old for the local Administrator account for administering the computer/domain, this is a finding.

Fix text

Change the enabled local Administrator account password at least every "60" days. AutomatedIt tools,is suchhighly asrecommended to use Microsoft's LAPS, which may be used on domain-joined member servers to meet this requirement. The AO still has the overall authority to use another equivalent capability to accomplish the check.

Discussion

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure. OrganizationsIt thatis usehighly anrecommended automatedto tool,use such Microsoft's Local Administrator Password Solution (LAPS),. on domainDomain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default. The AO still has the overall authority to use another equivalent capability to accomplish the check.

V-220952 in V2R3