Microsoft Windows Server 2016 Security Technical Implementation Guide

The Microsoft Windows Server 2016 Security Technical Implementation Guide (V2 R10) has 273 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

273STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R10

CurrentPublished Wed Jan 15 2025

Secure Boot must be enabled on Windows Server 2016 systems.

Microsoft Windows Server 2016 Security Technical Implementation Guide

Assessment Title

Rule Text

Secure Boot must be enabled on Windows Server 2016 systems.

Description

Discussion Text

Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows Server 2016, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-224864

Rule

SV-224864r991589_rule

Severity

low

Rule Version

WN16-00-000470

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. 

Run "System Information".

Under "System Summary", if "Secure Boot State" does not display "On", this is a finding.

Implementation Procedure

Fix Text

Enable Secure Boot in the system firmware.

STIG check 46 of 273 in the Microsoft Windows Server 2016 STIG checklist

← Previous · V-224863Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016.Next · V-224865 →Windows 2016 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.