Windows strictest published profile

Microsoft Windows 11 V2R11 + Windows 11 v26h2 v2 + SP 800-53 High

Build from STIG Microsoft baseline Include CAT III Show check and fix text

Export the kept items Apply with Every field: check, fix, controls, registry, payloads, Intune and DISA's checklist. Untick an item, then Rebuild or export; the page starts from the owner's decisions, so an item marked not applying starts unticked. One section is drawn at a time; what you untick in one is kept when you open another, and every export covers the whole profile.

STIG rules: CAT I 27 kept

Every CAT I rule of Microsoft Windows 11 V2R11: the ones DISA rates most severe.

WN11-00-000030 CAT I Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.
Recommended: apply SC-28(1) DISA: Not applicable to the policy
How to apply
DISA checklist
Not applicable to the policy: Outside scope of GPO configurations
WN11-00-000031 CAT I Windows 11 systems must use a BitLocker PIN for pre-boot authentication.
Recommended: apply SC-28(1) DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
no matching definition in DISA's package
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\UseAdvancedStartup (REG_DWORD) = 0x00000001 (1); HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\UseTPMPIN (REG_DWORD) = 0x00000001 (1); HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\UseTPMKeyPIN (REG_DWORD) = 0x00000001 (1); HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\UseTPMPIN (REG_DWORD) = 0x00000002 (2); HKEY_LOCAL_MACHINE\SOFT…
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-00-000040 CAT I Windows 11 systems must be maintained at a supported servicing level.
Recommended: apply CM-6 DISA: Not applicable to the policy
How to apply
DISA checklist
Not applicable to the policy: Outside scope of GPO configurations
WN11-00-000045 CAT I The Windows 11 system must use an antivirus program.
Recommended: apply CM-6 DISA: Not applicable to the policy
How to apply
DISA checklist
Not applicable to the policy: Outside scope of GPO configurations
WN11-00-000050 CAT I Local volumes must be formatted using NTFS.
Recommended: apply AC-3 DISA: Not applicable to the policy
How to apply
DISA checklist
Not applicable to the policy: Outside scope of GPO configurations
WN11-00-000070 CAT I Only accounts responsible for the administration of a system must have Administrator rights on the system.
Recommended: apply AC-3(4) DISA: Not applicable to the policy
How to apply
DISA checklist
Not applicable to the policy: Outside scope of GPO configurations
WN11-00-000100 CAT I Internet Information System (IIS) or its subcomponents must not be installed on a workstation.
Recommended: apply CM-7 DISA: Not applicable to the policy
How to apply
DISA checklist
Not applicable to the policy: Outside scope of GPO configurations
WN11-00-000150 CAT I Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
Recommended: apply SI-16 Intune: 1 definition DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 0
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_mssecurityguide_enablestructuredexceptionhandlingoverwriteprotection = 1
Group Policy path
Computer Configuration >> Administrative Templates >> MS Security Guide >> "Enable Structured Exception Handling Overwrite Protection (SEHOP)"
Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation (REG_DWORD) = 0x00000000 (0)
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 0
WN11-00-000240 CAT I Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.
Recommended: apply CM-6 DISA: Not applicable to the policy
How to apply
DISA checklist
Not applicable to the policy: Outside scope of GPO configurations
WN11-AC-000045 CAT I Reversible password encryption must be disabled.
Recommended: apply IA-5(1) DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
no matching definition in DISA's package
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption"
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - Set-StigDSC.ps1
WN11-CC-000075 CAT I Credential Guard must be running on Windows 11 systems.
Recommended: apply CM-6 Intune: 1 definition DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 1
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_deviceguard_lsacfgflags = 1
Group Policy path
Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On virtualization-based Security"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlags (REG_DWORD) = 0x00000001 (1) (Enabled with UEFI lock)
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 1
WN11-CC-000155 CAT I Solicited Remote Assistance must not be allowed.
Recommended: apply SC-4 DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 0
How to apply
Settings catalog (DISA's policy)
no matching definition in DISA's package
Group Policy path
Computer Configuration >> Administrative Templates >> System >> Remote Assistance >> "Configure Solicited Remote Assistance"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fAllowToGetHelp (REG_DWORD) = 0
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 0
WN11-CC-000180 CAT I Autoplay must be turned off for non-volume devices.
Recommended: apply CM-7(2) Intune: 1 definition DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 1
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_autoplay_disallowautoplayfornonvolumedevices = 1
Group Policy path
Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer\NoAutoplayfornonVolume (REG_DWORD) = 1
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 1
WN11-CC-000185 CAT I The default autorun behavior must be configured to prevent autorun commands.
Recommended: apply CM-7(2) DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 1
How to apply
Settings catalog (DISA's policy)
no matching definition in DISA's package
Group Policy path
Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoAutorun (REG_DWORD) = 1
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 1
WN11-CC-000190 CAT I Autoplay must be disabled for all drives.
Recommended: apply CM-7(2) Intune: 1 definition DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 255
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_autoplay_turnoffautoplay = 1; autorun_box = 255
Group Policy path
Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun (REG_DWORD) = 0x000000ff (255)
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 255
WN11-CC-000315 CAT I The Windows Installer feature "Always install with elevated privileges" must be disabled.
Recommended: apply CM-11(2) Intune: 1 definition DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 0
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_applicationmanagement_msialwaysinstallwithelevatedprivileges = 0
Group Policy path
Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated (REG_DWORD) = 0
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 0
WN11-CC-000330 CAT I The Windows Remote Management (WinRM) client must not use Basic authentication.
Recommended: apply MA-4 Intune: 2 definitions DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 0
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_remotemanagement_allowbasicauthentication_client = 0; device_vendor_msft_policy_config_remotemanagement_allowbasicauthentication_service = 0
Group Policy path
Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\AllowBasic (REG_DWORD) = 0
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 0
WN11-CC-000345 CAT I The Windows Remote Management (WinRM) service must not use Basic authentication.
Recommended: apply MA-4 Intune: 2 definitions DISA: Covered by DISA's policy Microsoft baseline: REG_DWORD = 0
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_remotemanagement_allowbasicauthentication_client = 0; device_vendor_msft_policy_config_remotemanagement_allowbasicauthentication_service = 0
Group Policy path
Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication"
Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\AllowBasic (REG_DWORD) = 0
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
Microsoft baseline value
REG_DWORD = 0
WN11-SO-000140 CAT I Anonymous SID/Name translation must not be allowed.
Recommended: apply CM-6 DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
no matching definition in DISA's package
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation"
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - Set-STIGDSC.ps1
WN11-SO-000145 CAT I Anonymous enumeration of SAM accounts must not be allowed.
Recommended: apply CM-6 Intune: 2 definitions DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_localpoliciessecurityoptions_networkaccess_donotallowanonymousenumerationofsamaccounts = 1; device_vendor_msft_policy_config_localpoliciessecurityoptions_networkaccess_donotallowanonymousenumerationofsamaccountsandshares = 1
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts"
Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM (REG_DWORD) = 1
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-SO-000150 CAT I Anonymous enumeration of shares must be restricted.
Recommended: apply SC-4 Intune: 2 definitions DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_localpoliciessecurityoptions_networkaccess_donotallowanonymousenumerationofsamaccountsandshares = 1; device_vendor_msft_policy_config_localpoliciessecurityoptions_networkaccess_restrictanonymousaccesstonamedpipesandshares = 1
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares"
Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous (REG_DWORD) = 1
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-SO-000165 CAT I Anonymous access to Named Pipes and Shares must be restricted.
Recommended: apply SC-4 Intune: 1 definition DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_localpoliciessecurityoptions_networkaccess_restrictanonymousaccesstonamedpipesandshares = 1
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares"
Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess (REG_DWORD) = 1
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-SO-000195 CAT I The system must be configured to prevent the storage of the LAN Manager hash of passwords.
Recommended: apply IA-5(1) Intune: 1 definition DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_localpoliciessecurityoptions_networksecurity_donotstorelanmanagerhashvalueonnextpasswordchange = 1
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change"
Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\NoLMHash (REG_DWORD) = 1
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-SO-000205 CAT I The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.
Recommended: apply CM-6 Intune: 1 definition DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_localpoliciessecurityoptions_networksecurity_lanmanagerauthenticationlevel = 5
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level"
Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel (REG_DWORD) = 5
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-UR-000015 CAT I The "Act as part of the operating system" user right must not be assigned to any groups or accounts.
Recommended: apply AC-6(10) Intune: 1 definition DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_userrights_actaspartoftheoperatingsystem = null
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system"
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-UR-000045 CAT I The "Create a token object" user right must not be assigned to any groups or accounts.
Recommended: apply AC-6(10) DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
no matching definition in DISA's package
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object"
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog
WN11-UR-000065 CAT I The "Debug programs" user right must only be assigned to the Administrators group.
Recommended: apply AC-6(10) Intune: 1 definition DISA: Covered by DISA's policy
How to apply
Settings catalog (DISA's policy)
device_vendor_msft_policy_config_userrights_debugprograms = Administrators
Group Policy path
Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs"
DISA checklist
Covered by DISA's policy: GPO - DoD Windows 11 Computer STIG v2r11 Intune - DoD Windows 11 STIG v2r11 Settings Catalog

Built from

STIG: Microsoft Windows 11 V2R11 2026-10-05
Microsoft baseline: Windows 11 v26h2 v2
Controls: SP 800-53 High baseline 5.2.0
CCI list 2026-07-14
DISA Intune policy: DoD Windows 11 STIG Settings Catalog October 2026
DISA checklist: DoD Windows 11 STIG October 2026
Kept: 985 of 985
Decisions: 0 modified, 0 not applied; the rest as published

Current versus next

No newer version of the STIG, the Microsoft baseline is loaded; when one arrives this box lists what the strict set gains and loses.

Whose words

STIG rules: DISA (public domain). Controls: NIST SP 800-53 Rev 5 (public domain), mapped through DISA's CCIs. Microsoft's values: your own copy of the Security Compliance Toolkit, never redistributed. Intune definitions and checklist verdicts: DISA's own packages. No CIS text, nothing from a model.

The Windows decisions · The Windows test plan · The Windows STIG pages · All platforms