Microsoft Windows Server 2016 Security Technical Implementation Guide

The Microsoft Windows Server 2016 Security Technical Implementation Guide (V2 R10) has 273 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

273STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R10

CurrentPublished Wed Jan 15 2025

FTP servers must be configured to prevent access to the system drive.

Microsoft Windows Server 2016 Security Technical Implementation Guide

Assessment Title

Rule Text

FTP servers must be configured to prevent access to the system drive.

Description

Discussion Text

The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-224861

Rule

SV-224861r991589_rule

Severity

medium

Rule Version

WN16-00-000440

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If FTP is not installed on the system, this is NA.

Open "Internet Information Services (IIS) Manager".

Select "Sites" under the server name.

For any sites with a Binding that lists FTP, right-click the site and select "Explore".

If the site is not defined to a specific folder for shared FTP resources, this is a finding.

If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding.

Implementation Procedure

Fix Text

Configure the FTP sites to allow access only to specific FTP shared resources. Do not allow access to other areas of the system.

STIG check 43 of 273 in the Microsoft Windows Server 2016 STIG checklist

← Previous · V-224860FTP servers must be configured to prevent anonymous logons.Next · V-224862 →The time service must synchronize with an appropriate DoD time source.