DISA STIG library V2R11
| Ref | Title | Text | |
|---|---|---|---|
| WN11-00-000030 | Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest. | For AVD implementations with no data at rest, this is NA. Verify all Windows 11 information systems (including SIPRNet) employ BitLocker for full disk encryption. If full disk encryption using BitLocker is not implemented, this is a finding | |
| WN11-00-000031 | Windows 11 systems must use a BitLocker PIN for pre-boot authentication. | For AVD implementations with no data at rest, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\FVE | |
| WN11-00-000040 | Windows 11 systems must be maintained at a supported servicing level. | 1. Determine your Windows 11 OS version. a. Run "winver.exe". The "About Windows" dialog box will display the system's version and OS build. For example, "Microsoft Windows 11 Version 24H2 (OS Build 26100.8875)". Record the numbers observed | |
| WN11-00-000045 | The Windows 11 system must use an antivirus program. | Verify an organizationally approved antivirus solution (Microsoft Defender Antivirus, for example) is installed on the system and in use. Verify if Microsoft Defender Antivirus is in use or enabled: If Windows Defender is your primary or se | |
| WN11-00-000050 | Local volumes must be formatted using NTFS. | Run "Computer Management". Navigate to Storage >> Disk Management. If the "File System" column does not indicate "NTFS" for each volume assigned a drive letter, this is a finding. This does not apply to system partitions such the Recovery a | |
| WN11-00-000070 | Only accounts responsible for the administration of a system must have Administrator rights on the system. | Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may | |
| WN11-00-000100 | Internet Information System (IIS) or its subcomponents must not be installed on a workstation. | Verify it has not been installed on the system. Run "Programs and Features". Select "Turn Windows features on or off". If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, thi | |
| WN11-00-000150 | Structured Exception Handling Overwrite Protection (SEHOP) must be enabled. | Verify SEHOP is turned on. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\kernel\ Value | |
| WN11-00-000240 | Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email. | Determine whether administrative accounts are prevented from using applications that access the internet, such as web browsers, or with potential internet sources, such as email, except as necessary for local service administration. The org | |
| WN11-AC-000045 | Reversible password encryption must be disabled. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Stor | |
| WN11-CC-000075 | Credential Guard must be running on Windows 11 systems. | Confirm Credential Guard is running. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" If "SecurityServicesRun | |
| WN11-CC-000155 | Solicited Remote Assistance must not be allowed. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowToGetHelp Val | |
| WN11-CC-000180 | Autoplay must be turned off for non-volume devices. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value Ty | |
| WN11-CC-000185 | The default autorun behavior must be configured to prevent autorun commands. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value | |
| WN11-CC-000190 | Autoplay must be disabled for all drives. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoR | |
| WN11-CC-000315 | The Windows Installer feature "Always install with elevated privileges" must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value Ty | |
| WN11-CC-000330 | The Windows Remote Management (WinRM) client must not use Basic authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value Type: REG_ | |
| WN11-CC-000345 | The Windows Remote Management (WinRM) service must not use Basic authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value Type: REG | |
| WN11-SO-000140 | Anonymous SID/Name translation must not be allowed. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Netwo | |
| WN11-SO-000145 | Anonymous enumeration of SAM accounts must not be allowed. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DW | |
| WN11-SO-000150 | Anonymous enumeration of shares must be restricted. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value Type: REG_DWORD | |
| WN11-SO-000165 | Anonymous access to Named Pipes and Shares must be restricted. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAc | |
| WN11-SO-000195 | The system must be configured to prevent the storage of the LAN Manager hash of passwords. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value Type: REG_DWORD Value: 1 | |
| WN11-SO-000205 | The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value Type: REG_DW | |
| WN11-UR-000015 | The "Act as part of the operating system" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000045 | The "Create a token object" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or | |
| WN11-UR-000065 | The "Debug programs" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or |
27 of 257.