DISA STIG library V1R4
| Ref | Title | Text | |
|---|---|---|---|
| WN25-00-000001 | Windows Server 2025 must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs). | Review the operating system documentation and configuration to determine if the system checks in with a patch management system to install security-relevant software updates within a timeframe directed by an authoritative source. If the ope | |
| WN25-00-000002 | Windows Server 2025 must prohibit the use or connection of unauthorized hardware components. | Verify the operating system is configured to prohibit the use or connection of unauthorized hardware components. If the operating system is using undocumented or unapproved hardware, this is a finding. | |
| WN25-00-000010 | Windows Server 2025 users with administrative privileges must have separate accounts for administrative duties and normal operational tasks. | Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. If users with administrative privileges do not have separate accounts for administrative functions | |
| WN25-00-000020 | Windows Server 2025 passwords for the built-in Administrator account must be changed at least every 180 days. | If there are no enabled local Administrator accounts, this is not applicable. Review the password last set date for the enabled local Administrator account. On the standalone or domain-joined server: Open PowerShell. Enter "Get-LocalUser | | |
| WN25-00-000030 | Windows Server 2025 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email. | Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the internet or other public-facing networks. These applications include web browsers or applications with potential | |
| WN25-00-000040 | Windows Server 2025 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. | If no accounts are members of the Backup Operators group, this is not applicable. Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. If users with | |
| WN25-00-000050 | Windows Server 2025 manually managed application account passwords must be at least 15 characters in length. | Determine if manually managed application/service accounts exist. If none exist, this is not applicable. Verify the organization has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters i | |
| WN25-00-000060 | Windows Server 2025 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. | Determine if manually managed application/service accounts exist. If none exist, this is not applicable. If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledg | |
| WN25-00-000070 | Windows Server 2025 shared user accounts must not be permitted. | Determine whether any shared accounts exist. If no shared accounts exist, this is not applicable. Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the information system | |
| WN25-00-000080 | Windows Server 2025 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. | Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. If an application allowlisting program is not in use on the system, this is a finding. Configuration of allow | |
| WN25-00-000090 | Windows Server 2025 systems must have a Trusted Platform Module (TPM) enabled and ready for use. | Verify the system has a TPM and it is ready for use. Run "tpm.msc". Review the sections in the center pane. "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has | |
| WN25-00-000110 | Windows Server 2025 must use an antivirus program. | Verify an antivirus solution is installed on the system. The antivirus solution may be bundled with an approved host-based security solution. If there is no antivirus solution installed on the system, this is a finding. Verify if Microsoft | |
| WN25-00-000120 | Windows Server 2025 must have a host-based intrusion detection and prevention service (IDPS) installed. | Determine whether there is a host based intrusion detection and prevention service on each server. This requirement is not applicable on a system that has the role as the IDPS. However, this exception must be documented with the information | |
| WN25-00-000130 | Windows Server 2025 local volumes must use a format that supports New Technology File System (NTFS) attributes. | Open "Computer Management". Select "Disk Management" under "Storage". For each local volume, if the file system does not indicate "NTFS", this is a finding. "ReFS" (Resilient File System) is also acceptable and would not be a finding. "CSVF | |
| WN25-00-000140 | Windows Server 2025 permissions for the system drive root directory (usually C:\) must conform to minimum requirements. | The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN25-SO-000240). Review the permissions for the system drive's root directory (usually C | |
| WN25-00-000150 | Windows Server 2025 permissions for program file directories must conform to minimum requirements. | The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN25-SO-000240). Review the permissions for the program file directories (Program Files | |
| WN25-00-000160 | Windows Server 2025 permissions for the Windows installation directory must conform to minimum requirements. | The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN25-SO-000240). Review the permissions for the Windows installation directory (usually | |
| WN25-00-000170 | Windows Server 2025 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained. | Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. If any nonprivileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. If permissions are no | |
| WN25-00-000180 | Windows Server 2025 nonadministrative accounts or groups must only have print permissions on printer shares. | Open "Printers & scanners" in "Settings". If there are no printers configured, this is not applicable. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) For each printer: Select the printer an | |
| WN25-00-000190 | Outdated or unused accounts on Windows Server 2025 must be removed or disabled. | Open Windows PowerShell. Domain Controllers: Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00". This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enable | |
| WN25-00-000200 | Windows Server 2025 accounts must require passwords. | Review the password required status for enabled user accounts. Open PowerShell. Domain Controllers: Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled". Exclude disabled accounts (e.g., Defaul | |
| WN25-00-000210 | Windows Server 2025 passwords must be configured to expire. | Review the password never expires status for enabled user accounts. Open PowerShell. Domain Controllers: Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | FT Name, PasswordNeverExpires, Enabled". Exclude application accounts, disab | |
| WN25-00-000220 | Windows Server 2025 system files must be monitored for unauthorized changes. | Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. If system files are not monitored for unauthorized changes, this is a fin | |
| WN25-00-000230 | Windows Server 2025 nonsystem-created file shares must limit access to groups that require it. | If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is not applicable. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) | |
| WN25-00-000240 | Windows Server 2025 must have software certificate installation files removed. | Search all drives for *.p12 and *.pfx files. If any files with these extensions exist, this is a finding. This does not apply to server-based applications that have a requirement for .p12 or .pfx certificate files. Some applications create | |
| WN25-00-000250 | Windows Server 2025 systems requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. | Note: If there is a documented and approved reason to omit data-at-rest encryption at the operating system level, such as encryption provided by a hypervisor or a disk storage array in a virtualized environment, this requirement is not appl | |
| WN25-00-000260 | Windows Server 2025 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. | If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPsec have been impl | |
| WN25-00-000270 | Windows Server 2025 must have the roles and features required by the system documented. | Required roles and features will vary based on the function of the individual system. Roles and features specifically required to be disabled per the STIG are identified in separate requirements. Run the following Powershell command to dete | |
| WN25-00-000280 | Windows Server 2025 must have a host-based firewall installed and enabled. | Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. The configuration requirements will be determined by the applicable firewall | |
| WN25-00-000300 | Windows Server 2025 must automatically remove or disable temporary user accounts after 72 hours. | Review temporary user accounts for expiration dates. Determine if temporary user accounts are used and identify any that exist. If none exist, this is not applicable. Domain Controllers: Open PowerShell. Enter "Search-ADAccount -AccountExpi | |
| WN25-00-000310 | Windows Server 2025 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours. | Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is not applicable. If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accoun | |
| WN25-00-000320 | Windows Server 2025 must not have the Fax Server role installed. | Open PowerShell. Enter "Get-WindowsFeature | Where Name -eq Fax". If "Installed State" is "Installed", this is a finding. An Installed State of "Available" or "Removed" is not a finding. | |
| WN25-00-000330 | Windows Server 2025 must not have the Microsoft FTP service installed unless required by the organization. | If the server has the role of an FTP server, this is not applicable. Open PowerShell. Enter "Get-WindowsFeature | Where Name -eq Web-Ftp-Service". If "Installed State" is "Installed", this is a finding. An Installed State of "Available" or | |
| WN25-00-000332 | Windows Server 2025 must not have Wi-Fi enabled unless required by the organization. | Open PowerShell or a Command prompt. Type " ipconfig /all". Review the resulting display for existence of a Wireless LAN or Wi-Fi connection. If none are listed, issue the following command in PowerShell: Get-NetAdapter | Where-Object Physi | |
| WN25-00-000333 | Windows Server 2025 must not have Bluetooth enabled unless required by the organization. | In the Windows search bar, type "Services". In the Services "Name" column look for the "Bluetooth Support Service". If this is set to "automatic", this is a finding. | |
| WN25-00-000340 | Windows Server 2025 must not have the Peer Name Resolution Protocol installed. | Open PowerShell. Enter "Get-WindowsFeature | Where Name -eq PNRP". If "Installed State" is "Installed", this is a finding. An Installed State of "Available" or "Removed" is not a finding. | |
| WN25-00-000350 | Windows Server 2025 must not have Simple TCP/IP Services installed. | Open PowerShell. Enter "Get-WindowsFeature | Where Name -eq Simple-TCPIP". If "Installed State" is "Installed", this is a finding. An Installed State of "Available" or "Removed" is not a finding. | |
| WN25-00-000360 | Windows Server 2025 must not have the Telnet Client installed. | Open PowerShell. Enter "Get-WindowsFeature | Where Name -eq Telnet-Client". If "Installed State" is "Installed", this is a finding. An Installed State of "Available" or "Removed" is not a finding. | |
| WN25-00-000370 | Windows Server 2025 must not have the TFTP Client installed. | Open PowerShell. Enter "Get-WindowsFeature | Where Name -eq TFTP-Client". If "Installed State" is "Installed", this is a finding. An Installed State of "Available" or "Removed" is not a finding. | |
| WN25-00-000380 | Windows Server 2025 must not have the Server Message Block (SMB) v1 protocol installed. | Different methods are available to disable SMBv1 on Windows Server 2025. This is the preferred method, however if WN25-00-000390 and WN25-00-000400 are configured, this is not applicable. Open Windows PowerShell with elevated privileges (ru | |
| WN25-00-000390 | Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server. | Different methods are available to disable SMBv1 on Windows Server 2025, if WN25-00-000380 is configured, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry | |
| WN25-00-000400 | Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client. | Different methods are available to disable SMBv1 on Windows Server 2025, if WN25-00-000380 is configured, this is not applicable. If the following registry value is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_M | |
| WN25-00-000410 | Windows Server 2025 must not have Windows PowerShell 2.0 installed. | Open PowerShell. Enter "Get-WindowsFeature | Where Name -eq PowerShell-v2". If "Installed State" is "Installed", this is a finding. An Installed State of "Available" or "Removed" is not a finding. | |
| WN25-00-000420 | Windows Server 2025 FTP servers must be configured to prevent anonymous logons. | If FTP is not installed on the system, this is not applicable. Open Internet Information Services (IIS) Manager. Select the server. Double-click "FTP Authentication". If the "Anonymous Authentication" status is "Enabled", this is a finding. | |
| WN25-00-000430 | Windows Server 2025 FTP servers must be configured to prevent access to the system drive. | If FTP is not installed on the system, this is not applicable. Open Internet Information Services (IIS) Manager. Select "Sites" under the server name. For any sites with a Binding that lists FTP, right-click the site and select "Explore". I | |
| WN25-00-000440 | The Windows Server 2025 time service must synchronize with an appropriate DoW time source. | Review the Windows time service configuration. Open an elevated command prompt (run as administrator). Enter "W32tm /query /configuration". Domain-joined systems (excluding the domain controller with the PDC emulator role): If the value for | |
| WN25-00-000450 | Windows Server 2025 must have orphaned security identifiers (SIDs) removed from user rights. | Review the effective User Rights setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. Review | |
| WN25-00-000460 | Windows Server 2025 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. | Devices that have UEFI firmware must run in UEFI mode. Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS. Run "System Information". Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a findin | |
| WN25-00-000470 | Windows Server 2025 must have Secure Boot enabled. | Devices that have UEFI firmware must have Secure Boot enabled. Run "System Information". Under "System Summary", if "Secure Boot State" does not display "On", this is a finding. On server core installations, run the following PowerShell com | |
| WN25-00-000480 | Windows Server 2025 must be maintained at a supported servicing level. | 1. Determine the system's OS version. a. Open "Command Prompt". b. Run "winver.exe". The "About Windows" dialog box will display the system’s version and OS build. For example, "Microsoft Windows Server Version 25H2 (Build 26100.33296)". Th | |
| WN25-AC-000010 | Windows Server 2025 account lockout duration must be configured to 15 minutes or greater. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account l | |
| WN25-AC-000020 | Windows Server 2025 must have the number of allowed bad logon attempts configured to three or less. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account l | |
| WN25-AC-000030 | Windows Server 2025 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Reset acc | |
| WN25-AC-000040 | Windows Server 2025 password history must be configured to 24 passwords remembered. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Enforc | |
| WN25-AC-000050 | Windows Server 2025 maximum password age must be configured to 180 days or less. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Ma | |
| WN25-AC-000060 | Windows Server 2025 minimum password age must be configured to at least one day. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Mi | |
| WN25-AC-000080 | Windows Server 2025 must have the built-in Windows password complexity policy enabled. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Passwo | |
| WN25-AC-000090 | Windows Server 2025 reversible password encryption must be disabled. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Store | |
| WN25-AU-000010 | Windows Server 2025 audit records must be backed up to a different system or media than the system being audited. | Determine if a process to back up log data to a different system or media than the system being audited has been implemented. If it has not, this is a finding. | |
| WN25-AU-000020 | Windows Server 2025 must, at a minimum, off-load audit records of interconnected systems in real time and off-load stand-alone or nondomain-joined systems weekly. | Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for stand-alone or nondomain-joined systems weekly. If they are not, this is a finding. | |
| WN25-AU-000030 | Windows Server 2025 permissions for the Application event log must prevent access by nonprivileged accounts. | Navigate to the Application event log file. The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. If the permissions for the "Application.evtx" file are not as restr | |
| WN25-AU-000040 | Windows Server 2025 permissions for the Security event log must prevent access by nonprivileged accounts. | Navigate to the Security event log file. The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. If the permissions for the "Security.evtx" file are not as restrictive | |
| WN25-AU-000050 | Windows Server 2025 permissions for the System event log must prevent access by nonprivileged accounts. | Navigate to the System event log file. The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. If the permissions for the "System.evtx" file are not as restrictive as | |
| WN25-AU-000060 | Windows Server 2025 Event Viewer must be protected from unauthorized modification and deletion. | This is not applicable for Windows Core Edition. Navigate to "%SystemRoot%\System32". View the permissions on "Eventvwr.exe". If any groups or accounts other than TrustedInstaller have "Full control" or "Modify" permissions, this is a findi | |
| WN25-AU-000070 | Windows Server 2025 must be configured to audit Account Logon - Credential Validation successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000080 | Windows Server 2025 must be configured to audit Account Logon - Credential Validation failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000090 | Windows Server 2025 must be configured to audit Account Management - Other Account Management Events successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000100 | Windows Server 2025 must be configured to audit Account Management - Security Group Management successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000110 | Windows Server 2025 must be configured to audit Account Management - User Account Management successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000120 | Windows Server 2025 must be configured to audit Account Management - User Account Management failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000130 | Windows Server 2025 must be configured to audit Detailed Tracking - Plug and Play Events successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000140 | Windows Server 2025 must be configured to audit Detailed Tracking - Process Creation successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000150 | Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000160 | Windows Server 2025 must be configured to audit Logon/Logoff - Account Lockout failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000170 | Windows Server 2025 must be configured to audit Logon/Logoff - Group Membership successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000180 | Windows Server 2025 must be configured to audit logoff successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000190 | Windows Server 2025 must be configured to audit logon successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000200 | Windows Server 2025 must be configured to audit logon failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000210 | Windows Server 2025 must be configured to audit Logon/Logoff - Special Logon successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000220 | Windows Server 2025 must be configured to audit Object Access - Other Object Access Events successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000230 | Windows Server 2025 must be configured to audit Object Access - Other Object Access Events failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000240 | Windows Server 2025 must be configured to audit Object Access - Removable Storage successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000250 | Windows Server 2025 must be configured to audit Object Access - Removable Storage failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000260 | Windows Server 2025 must be configured to audit Policy Change - Audit Policy Change successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000270 | Windows Server 2025 must be configured to audit Policy Change - Audit Policy Change failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000280 | Windows Server 2025 must be configured to audit Policy Change - Authentication Policy Change successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000281 | Windows Server 2025 must be configured to audit Policy Change - Authorization Policy Change successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000300 | Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000310 | Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000320 | Windows Server 2025 must be configured to audit System - IPsec Driver successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000330 | Windows Server 2025 must be configured to audit System - IPsec Driver failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000340 | Windows Server 2025 must be configured to audit System - Other System Events successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000350 | Windows Server 2025 must be configured to audit System - Other System Events failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000360 | Windows Server 2025 must be configured to audit System - Security State Change successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000370 | Windows Server 2025 must be configured to audit System - Security System Extension successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000380 | Windows Server 2025 must be configured to audit System - System Integrity successes. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000390 | Windows Server 2025 must be configured to audit System - System Integrity failures. | Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-000050) for the detailed auditing subcategories to be effective. Use the "Aud | |
| WN25-AU-000583 | Windows Server 2025 must be configured to audit handle manipulation failures. | Verify Audit Handle Manipulation auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Handle Manipulation. If "Audit H | |
| WN25-AU-000585 | Windows Server 2025 must be configured to audit registry failures. | Verify Audit Registry auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Registry. If "Audit Registry" is not set to | |
| WN25-AU-000586 | Windows Server 2025 must be configured to audit registry successes. | Verify Audit Registry auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> Audit Registry. If "Audit Registry" is not set to | |
| WN25-AU-000587 | Windows Server 2025 must be configured to audit sensitive privilege use successes. | Verify Audit Sensitive Privilege Use auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> Audit Sensitive Privilege Use. If | |
| WN25-AU-000588 | Windows Server 2025 must be configured to audit sensitive privilege use failures. | Verify Audit Sensitive Privilege Use auditing is enabled: Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> Audit Sensitive Privilege Use. If | |
| WN25-CC-000010 | Windows Server 2025 must prevent the display of slide shows on the lock screen. | Verify the registry value below: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ Value Name: NoLockScreenSlideshow Value Type: REG_DWORD Value: 0x00000001 (1) If the registry value does | |
| WN25-CC-000030 | Windows Server 2025 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing. | Verify the registry value below: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisableIPSourceRouting Type: REG_DWORD Value: 0x00000002 (2) If the registry value does not | |
| WN25-CC-000040 | Windows Server 2025 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: DisableIPSourceRouting Va | |
| WN25-CC-000050 | Windows Server 2025 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableICMPRedirect Value | |
| WN25-CC-000060 | Windows Server 2025 must be configured to ignore NetBIOS name release requests except from WINS servers. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry HiveHKEY_LOCAL_MACHINE Registry Path\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ Value NameNoNameReleaseOnDemand Value Typ | |
| WN25-CC-000070 | Windows Server 2025 insecure logons to an SMB server must be disabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ Value Name: AllowInsecureGuestAuth | |
| WN25-CC-000080 | Windows Server 2025 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. | This requirement is applicable to domain-joined systems. For stand-alone or nondomain-joined systems, this is not applicable. If the following registry values do not exist or are not configured as specified, this is a finding: Registry Hive | |
| WN25-CC-000090 | Windows Server 2025 command line data must be included in process creation events. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ Value Name: ProcessCreat | |
| WN25-CC-000100 | Windows Server 2025 must be configured to enable Remote host allows delegation of nonexportable credentials. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ Value Name: AllowProtectedCred | |
| WN25-CC-000110 | Windows Server 2025 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. | For stand-alone or nondomain-joined systems, this is not applicable. Open PowerShell with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\Devic | |
| WN25-CC-000130 | Windows Server 2025 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad. | The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). If the registry value name below does not exist, this is not a finding. If it | |
| WN25-CC-000140 | Windows Server 2025 group policy objects must be reprocessed even if they have not changed. | This is not applicable for Domain Controllers. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group | |
| WN25-CC-000150 | Windows Server 2025 downloading print driver packages over HTTP must be turned off. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableWebPnPDownload Type: | |
| WN25-CC-000160 | Windows Server 2025 printing over HTTP must be turned off. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableHTTPPrinting Type: RE | |
| WN25-CC-000170 | Windows Server 2025 network selection user interface (UI) must not be displayed on the logon screen. | Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ Value Name: DontDisplayNetworkSelectio | |
| WN25-CC-000180 | Windows Server 2025 users must be prompted to authenticate when the system wakes from sleep (on battery). | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ Val | |
| WN25-CC-000190 | Windows Server 2025 users must be prompted to authenticate when the system wakes from sleep (plugged in). | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ Val | |
| WN25-CC-000200 | Windows Server 2025 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ Value Name: DisableInventory Type: REG_DWO | |
| WN25-CC-000210 | Windows Server 2025 AutoPlay must be turned off for nonvolume devices. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Type: RE | |
| WN25-CC-000220 | Windows Server 2025 default AutoRun behavior must be configured to prevent AutoRun commands. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Type: | |
| WN25-CC-000230 | Windows Server 2025 AutoPlay must be disabled for all drives. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun | |
| WN25-CC-000240 | Windows Server 2025 administrator accounts must not be enumerated during elevation. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ Value Name: EnumerateAdministr | |
| WN25-CC-000250 | Windows Server 2025 Telemetry must be configured to limit diagnostic data sent to Microsoft. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ Value Name: AllowTelemetry Type: REG_ | |
| WN25-CC-000260 | Windows Server 2025 Windows Update must not obtain updates from other PCs on the internet. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ Value Name: DODownloadMode Valu | |
| WN25-CC-000270 | Windows Server 2025 Application event log size must be configured to 32768 KB or greater. | If the system is configured to write events directly to an audit server, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry | |
| WN25-CC-000280 | Windows Server 2025 Security event log size must be configured to a value that holds at least one week of audit records. | If the system is configured to write events directly to an audit server, this is not applicable. The registry configuration setting below must be set (at least) to a value equal to the size needed to contain one week's worth of audit record | |
| WN25-CC-000290 | Windows Server 2025 System event log size must be configured to 32768 KB or greater. | If the system is configured to write events directly to an audit server, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry | |
| WN25-CC-000300 | Windows Server 2025 Microsoft Defender antivirus SmartScreen must be enabled. | This is applicable to unclassified systems; for other systems, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SO | |
| WN25-CC-000310 | Windows Server 2025 Explorer Data Execution Prevention must be enabled. | The default behavior is for Data Execution Prevention to be turned on for File Explorer. If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If i | |
| WN25-CC-000320 | Windows Server 2025 Turning off File Explorer heap termination on corruption must be disabled. | The default behavior is for File Explorer heap termination on corruption to be enabled. If the registry Value Name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it | |
| WN25-CC-000330 | Windows Server 2025 File Explorer shell protocol must run in protected mode. | The default behavior is for shell protected mode to be turned on for File Explorer. If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it exi | |
| WN25-CC-000340 | Windows Server 2025 must not save passwords in the Remote Desktop Client. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: DisablePasswordSavi | |
| WN25-CC-000350 | Windows Server 2025 Remote Desktop Services must prevent drive redirection. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableCdm Type: R | |
| WN25-CC-000360 | Windows Server 2025 Remote Desktop Services must always prompt a client for passwords upon connection. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fPromptForPassword | |
| WN25-CC-000370 | Windows Server 2025 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fEncryptRPCTraffic | |
| WN25-CC-000380 | Windows Server 2025 Remote Desktop Services must be configured with the client connection encryption set to High Level. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: MinEncryptionLevel | |
| WN25-CC-000390 | Windows Server 2025 must prevent attachments from being downloaded from RSS feeds. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ Value Name: DisableEnclosureDownload | |
| WN25-CC-000400 | Windows Server 2025 must disable Basic authentication for RSS feeds over HTTP. | The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is | |
| WN25-CC-000410 | Windows Server 2025 must prevent Indexing of encrypted files. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ Value Name: AllowIndexingEncryptedSto | |
| WN25-CC-000420 | Windows Server 2025 must prevent users from changing installation options. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: EnableUserControl Type: REG_DW | |
| WN25-CC-000430 | Windows Server 2025 must disable the Windows Installer Always install with elevated privileges option. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Type: RE | |
| WN25-CC-000440 | Windows Server 2025 users must be notified if a web-based program attempts to install software. | The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. If the registry value name below does not exist, this is not | |
| WN25-CC-000450 | Windows Server 2025 must disable automatically signing in the last interactive user after a system-initiated restart. | Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableAuto | |
| WN25-CC-000460 | Windows Server 2025 PowerShell script block logging must be enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ Value Name: EnableScri | |
| WN25-CC-000470 | Windows Server 2025 Windows Remote Management (WinRM) client must not use Basic authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Type: REG_DWORD | |
| WN25-CC-000480 | Windows Server 2025 Windows Remote Management (WinRM) client must not allow unencrypted traffic. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowUnencryptedTraffic Typ | |
| WN25-CC-000490 | Windows Server 2025 Windows Remote Management (WinRM) client must not use Digest authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowDigest Type: REG_DWORD | |
| WN25-CC-000500 | Windows Server 2025 Windows Remote Management (WinRM) service must not use Basic authentication. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Type: REG_DWORD | |
| WN25-CC-000510 | Windows Server 2025 Windows Remote Management (WinRM) service must not allow unencrypted traffic. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowUnencryptedTraffic Ty | |
| WN25-CC-000520 | Windows Server 2025 Windows Remote Management (WinRM) service must not store RunAs credentials. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: DisableRunAs Type: REG_DWO | |
| WN25-CC-000530 | Windows Server 2025 must have PowerShell Transcription enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscrip | |
| WN25-DC-000010 | Windows Server 2025 must only allow administrators responsible for the domain controller to have Administrator rights on the system. | This applies to domain controllers. A separate version applies to other systems. Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group | |
| WN25-DC-000020 | Windows Server 2025 Kerberos user logon restrictions must be enforced. | This applies to domain controllers. It is not applicable for other systems. Verify the following is configured in the Default Domain Policy: Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Fo | |
| WN25-DC-000030 | Windows Server 2025 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less. | This applies to domain controllers. It is not applicable for other systems. Verify the following is configured in the Default Domain Policy: Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Fo | |
| WN25-DC-000040 | Windows Server 2025 Kerberos user ticket lifetime must be limited to 10 hours or less. | This applies to domain controllers. It is not applicable for other systems. Verify the following is configured in the Default Domain Policy: Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Fo | |
| WN25-DC-000050 | Windows Server 2025 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less. | This applies to domain controllers. It is not applicable for other systems. Verify the following is configured in the Default Domain Policy: Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Fo | |
| WN25-DC-000060 | Windows Server 2025 computer clock synchronization tolerance must be limited to five minutes or less. | This applies to domain controllers. It is not applicable for other systems. Verify the following is configured in the Default Domain Policy: Open "Group Policy Management". Navigate to "Group Policy Objects" in the Domain being reviewed (Fo | |
| WN25-DC-000070 | Windows Server 2025 permissions on the Active Directory data files must only allow system administrators (SAs) access. | This applies to domain controllers. It is not applicable for other systems. Run "Regedit". Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". Note the directory locations in the values for: Database log file | |
| WN25-DC-000080 | Windows Server 2025 Active Directory SYSVOL directory must have the proper access control permissions. | This applies to domain controllers. It is not applicable for other systems. Open a command prompt. Run "net share". Make note of the directory location of the SYSVOL share. By default, this will be \Windows\SYSVOL\sysvol. For this requireme | |
| WN25-DC-000090 | Windows Server 2025 Active Directory (AD) Group Policy Objects (GPOs) must have proper access control permissions. | This applies to domain controllers. It is not applicable for other systems. Review the permissions on GPOs. Open "Group Policy Management" (available from various menus or run "gpmc.msc"). Navigate to "Group Policy Objects" in the domain be | |
| WN25-DC-000100 | Windows Server 2025 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions. | This applies to domain controllers. It is not applicable for other systems. Review the permissions on the Domain Controllers OU. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Select "Advanced F | |
| WN25-DC-000110 | Windows Server 2025 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. | This applies to domain controllers. It is not applicable for other systems. Review the permissions on domain-defined OUs. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Ensure "Advanced Features | |
| WN25-DC-000120 | Windows Server 2025 data files owned by users must be on a different logical partition from the directory server data files. | This applies to domain controllers. It is not applicable for other systems. Run "Regedit". Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". Note the directory locations in the values for "DSA Database file | |
| WN25-DC-000130 | Windows Server 2025 domain controllers must run on a machine dedicated to that function. | This applies to domain controllers, it is not applicable for other systems. Review the installed roles the domain controller is supporting. Start Server Manager. Select "AD DS" in the left pane then select the server name under "Servers" to | |
| WN25-DC-000140 | Windows Server 2025 must use separate, NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data. | This applies to domain controllers. It is not applicable for other systems. Review the organization network diagram(s) or documentation to determine the level of classification for the network(s) over which replication data is transmitted. | |
| WN25-DC-000150 | Windows Server 2025 directory data (outside the root DSE) of a nonpublic directory must be configured to prevent anonymous access. | This applies to domain controllers. It is not applicable for other systems. Open command prompt (not elevated). Run "ldp.exe". From the "Connection menu", select "Bind". Clear the User, Password, and Domain fields. Select "Simple bind" for | |
| WN25-DC-000160 | Windows Server 2025 directory service must be configured to terminate LDAP-based network connections to the directory server after five minutes of inactivity. | This applies to domain controllers. It is not applicable for other systems. Open an elevated command prompt (run as administrator). Enter "ntdsutil". At the "ntdsutil:" prompt, enter "LDAP policies". At the "ldap policy:" prompt, enter "con | |
| WN25-DC-000170 | Windows Server 2025 Active Directory Group Policy Objects (GPOs) must be configured with proper audit settings. | This applies to domain controllers. It is not applicable for other systems. Review the auditing configuration for all GPOs. Open "Group Policy Management" (available from various menus or run "gpmc.msc"). Navigate to "Group Policy Objects" | |
| WN25-DC-000180 | Windows Server 2025 Active Directory (AD) Domain object must be configured with proper audit settings. | This applies to domain controllers. It is not applicable for other systems. Review the auditing configuration for the Domain object. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Verify "Advanc | |
| WN25-DC-000190 | Windows Server 2025 Active Directory (AD) Infrastructure object must be configured with proper audit settings. | This applies to domain controllers. It is not applicable for other systems. Review the auditing configuration for the Infrastructure object. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Verify | |
| WN25-DC-000200 | Windows Server 2025 Active Directory (AD) Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings. | This applies to domain controllers. It is not applicable for other systems. Review the auditing configuration for the Domain Controller OU object. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). | |
| WN25-DC-000210 | Windows Server 2025 Active Directory (AD) AdminSDHolder object must be configured with proper audit settings. | This applies to domain controllers. It is not applicable for other systems. Review the auditing configuration for the "AdminSDHolder" object. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Verif | |
| WN25-DC-000220 | Windows Server 2025 Active Directory (AD) RID Manager$ object must be configured with proper audit settings. | This applies to domain controllers. It is not applicable for other systems. Review the auditing configuration for the "RID Manager$" object. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Verify | |
| WN25-DC-000230 | Windows Server 2025 must be configured to audit Account Management - Computer Account Management successes. | This applies to domain controllers. It is not applicable for other systems. Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-0 | |
| WN25-DC-000240 | Windows Server 2025 must be configured to audit DS Access - Directory Service Access successes. | This applies to domain controllers. It is not applicable for other systems. Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-0 | |
| WN25-DC-000250 | Windows Server 2025 must be configured to audit DS Access - Directory Service Access failures. | This applies to domain controllers. It is not applicable for other systems. Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-0 | |
| WN25-DC-000260 | Windows Server 2025 must be configured to audit DS Access - Directory Service Changes successes. | This applies to domain controllers. It is not applicable for other systems. Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-0 | |
| WN25-DC-000270 | Windows Server 2025 must be configured to audit DS Access - Directory Service Changes failures. | This applies to domain controllers. It is not applicable for other systems. Security Option "Audit: Force audit policy subcategory settings (Windows 7 or later) to override audit policy category settings" must be set to "Enabled" (WN25-SO-0 | |
| WN25-DC-000280 | Windows Server 2025 domain controllers must have a PKI server certificate. | This applies to domain controllers. It is not applicable for other systems. Run "MMC". Select "Add/Remove Snap-in" from the "File" menu. Select "Certificates" in the left pane, and then click "Add >". Select "Computer Account", and then cli | |
| WN25-DC-000290 | Windows Server 2025 domain Controller PKI certificates must be issued by the DoW PKI or an approved External Certificate Authority (ECA). | This applies to domain controllers. It is not applicable for other systems. Run "MMC". Select "Add/Remove Snap-in" from the "File" menu. Select "Certificates" in the left pane, and then click "Add >". Select "Computer Account", and then cli | |
| WN25-DC-000300 | Windows Server 2025 PKI certificates associated with user accounts must be issued by a DoW PKI or an approved External Certificate Authority (ECA). | This applies to domain controllers. It is not applicable for other systems. Review user account mappings to PKI certificates. Open PowerShell. Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled". Exclude disabled accounts (e. | |
| WN25-DC-000310 | Windows Server 2025 Active Directory (AD) user accounts, including administrators, must be configured to require the use of a common access card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication. | This applies to domain controllers. It is not applicable for other systems. Open PowerShell. Enter the following: "Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" ("DistinguishedName" may be subs | |
| WN25-DC-000320 | Windows Server 2025 domain controllers must require LDAP access signing. | This applies to domain controllers. It is not applicable for other systems. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\Curren | |
| WN25-DC-000330 | Windows Server 2025 domain controllers must be configured to allow reset of machine account passwords. | This applies to domain controllers. It is not applicable for other systems. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\Curren | |
| WN25-DC-000340 | The Windows Server 2025 "Access this computer from the network" user right must only be assigned to the Administrators, Authenticated Users, and Enterprise Domain Controllers groups on domain controllers. | This applies to domain controllers. It is not applicable for other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Securi | |
| WN25-DC-000350 | The Windows Server 2025 "Add workstations to domain" user right must only be assigned to the Administrators group on domain controllers. | This applies to domain controllers. It is not applicable for other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Securi | |
| WN25-DC-000360 | The Windows Server 2025 "Allow log on through Remote Desktop Services" user right must only be assigned to the Administrators group on domain controllers. | This applies to domain controllers, it is not applicable for other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Securi | |
| WN25-DC-000370 | The Windows Server 2025 "Deny access to this computer from the network" user right on domain controllers must be configured to prevent unauthenticated access. | This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> S | |
| WN25-DC-000380 | The Windows Server 2025 "Deny log on as a batch job" user right on domain controllers must be configured to prevent unauthenticated access. | This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> S | |
| WN25-DC-000390 | The Windows Server 2025 "Deny log on as a service" user right must be configured to include no accounts or groups (blank) on domain controllers. | This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> S | |
| WN25-DC-000400 | The Windows Server 2025 "Deny log on locally" user right on domain controllers must be configured to prevent unauthenticated access. | This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> S | |
| WN25-DC-000406 | Windows Server 2025 must be configured for name-based strong mappings for certificates. | This applies to domain controllers. This is not applicable for member servers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Administrative Template | |
| WN25-DC-000410 | The Windows Server 2025 "Deny log on through Remote Desktop Services" user right on domain controllers must be configured to prevent unauthenticated access. | This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> S | |
| WN25-DC-000420 | The Windows Server 2025 "Enable computer and user accounts to be trusted for delegation" user right must only be assigned to the Administrators group on domain controllers. | This applies to domain controllers. A separate version applies to other systems. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> S | |
| WN25-DC-000430 | The password for the krbtgt account on a domain must be reset at least every 180 days. | This requirement is applicable to domain controllers; it is not applicable for other systems. Open "Windows PowerShell". Enter "Get-ADUser krbtgt -Property PasswordLastSet". If the "PasswordLastSet" date is more than 180 days old, this is a | |
| WN25-MS-000010 | Windows Server 2025 must only allow administrators responsible for the member server or stand-alone or nondomain-joined system to have Administrator rights on the system. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Open "Computer Management". Navigate to "Groups" under "Local Users and Groups". Review the local "Administrators" | |
| WN25-MS-000020 | Windows Server 2025 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers. | This applies to member servers. For domain controllers and stand-alone or nondomain-joined systems, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry HiveHK | |
| WN25-MS-000030 | Windows Server 2025 local users on domain-joined member servers must not be enumerated. | This applies to member servers. For domain controllers and stand-alone or nondomain-joined systems, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: | |
| WN25-MS-000040 | Windows Server 2025 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and stand-alone or nondomain-joined systems. | This applies to member servers and stand-alone or nondomain-joined systems, it is not applicable for domain controllers. If the following registry value does not exist or is not configured as specified, this is a finding: Registry HiveHKEY_ | |
| WN25-MS-000050 | Windows Server 2025 must limit the caching of logon credentials to four or less on domain-joined member servers. | This applies to member servers. For domain controllers and stand-alone or nondomain-joined systems, this is not applicable. If the following registry value does not exist or is not configured as specified, this is a finding: Registry HiveHK | |
| WN25-MS-000060 | Windows Server 2025 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and stand-alone or nondomain-joined systems. | This applies to member servers and stand-alone or nondomain-joined systems; it is not applicable for domain controllers. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKE | |
| WN25-MS-000070 | Windows Server 2025 "Access this computer from the network" user right must only be assigned to the Administrators and Authenticated Users groups on domain-joined member servers and stand-alone or nondomain-joined systems. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Co | |
| WN25-MS-000080 | The Windows Server 2025 "Deny access to this computer from the network" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and local accounts and from unauthenticated access on all systems. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Co | |
| WN25-MS-000090 | Windows Server 2025 Deny log on as a batch job user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Co | |
| WN25-MS-000100 | The Windows Server 2025 "Deny log on as a service" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Co | |
| WN25-MS-000110 | The Windows Server 2025 "Deny log on locally" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Co | |
| WN25-MS-000120 | The Windows Server 2025 "Deny log on through Remote Desktop Services" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Co | |
| WN25-MS-000130 | The Windows Server 2025 "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts on domain-joined member servers and stand-alone or nondomain-joined systems. | This applies to member servers and stand-alone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Co | |
| WN25-MS-000140 | Windows Server 2025 must be running Credential Guard on domain-joined member servers. | For domain controllers and standalone or nondomain-joined systems, this is not applicable. If the system is being used as an Exchange server, this requirement is not applicable. Open PowerShell with elevated privileges (run as administrator | |
| WN25-PK-000010 | Windows Server 2025 must have the DoW Root Certificate Authority (CA) certificates installed in the Trusted Root Store. | Verify the DoW Root CA certificates are installed as Trusted Root Certification Authorities. The certificates referenced below apply to unclassified systems. Refer to the PKE documentation for other networks. Open PowerShell as an administr | |
| WN25-PK-000020 | Windows Server 2025 must have the DoW Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems. | This is applicable to unclassified systems. It is not applicable for others. Open "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DOD Interoperabil | |
| WN25-PK-000030 | Windows Server 2025 must have the US DoW CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems. | This is applicable to unclassified systems. It is not applicable for others. Open "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability | |
| WN25-SH-000010 | Windows Server 2025 networked systems must have and implement OpenSSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify that "OpenSSH" is installed with the following command: C:\ > Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*' Name : OpenSSH.Client~~~~ | |
| WN25-SH-000020 | Windows Server 2025 OpenSSH must display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the system via an OpenSSH logon. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify any SSH connection to the system displays the Standard Mandatory DoW Notice and Consent Banner before granting access to the system. Check for the locatio | |
| WN25-SH-000030 | Windows Server 2025 OpenSSH must accept public key authentication. | If OpenSSH is not installed on the system, this requirement is not applicable. If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. Verify the syste | |
| WN25-SH-000040 | Windows Server 2025 OpenSSH must not allow blank passwords. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify system remote access using OpenSSH prevents logging on with a blank password with the following command: C:\ > Get-Content "$env:ProgramData\ssh\sshd_conf | |
| WN25-SH-000050 | Windows Server 2025 OpenSSH must force a frequent session key renegotiation for SSH connections to the server. | If OpenSSH is not installed on the system, this requirement is NA. Verify the OpenSSH server is configured to force frequent session key renegotiation with the following command: C:\ > Get-Content "$env:ProgramData\ssh\sshd_config" | Select | |
| WN25-SH-000060 | Windows Server 2025 OpenSSH must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify the "ClientAliveCountMax" is set to "1" by performing the following command: C:\ > Get-Content "$env:ProgramData\ssh\sshd_config" | Select-String -Pattern | |
| WN25-SH-000070 | Windows Server 2025 OpenSSH must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify the "ClientAliveInterval" variable is set to a value of "600" or less by performing the following command: C:\ > Get-Content "$env:ProgramData\ssh\sshd_co | |
| WN25-SH-000080 | The Windows Server 2025 OpenSSH configuration file must conform to minimum requirements. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify the permissions of the "$env:ProgramData/ssh/sshd_config" file with the following command: C:\ > icacls $env:ProgramData/ssh/sshd_config C:\ProgramData\ss | |
| WN25-SH-000090 | Windows Server 2025 OpenSSH private host key files must conform to minimum requirements. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify the SSH private host key files permissions with the following command: C:\ > Get-ChildItem -Path "C:\ProgramData\ssh" -Filter "*_key" -File | ForEach-Obje | |
| WN25-SH-000100 | Windows Server 2025 OpenSSH public host key files must conform to minimum requirements. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify the SSH public host key files permissions with the following command: C:\ > Get-ChildItem -Path "C:\ProgramData\ssh" -Filter "*key.pub" -File | ForEach-Ob | |
| WN25-SH-000110 | Windows Server 2025 OpenSSH must not allow GSSAPI authentication. | If OpenSSH is not installed on the system, this requirement is not applicable. Verify the system does not allow GSSAPI authentication with the following command: C:\ > Get-Content "$env:ProgramData\ssh\sshd_config" | Select-String -Pattern | |
| WN25-SO-000010 | Windows Server 2025 must have the built-in guest account disabled. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Account | |
| WN25-SO-000020 | Windows Server 2025 must prevent local accounts with blank passwords from being used from the network. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value Type: REG_D | |
| WN25-SO-000030 | The Windows Server 2025 built-in administrator account must be renamed. | This applies to member servers and stand-alone or nondomain-joined systems; it is not applicable for domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Compu | |
| WN25-SO-000040 | The Windows Server 2025 built-in guest account must be renamed. | This applies to member servers and stand-alone or nondomain-joined systems; it is not applicable for domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Compu | |
| WN25-SO-000050 | Windows Server 2025 must force audit policy subcategory settings to override audit policy category settings. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: SCENoApplyLegacyAuditPolicy Value Type: | |
| WN25-SO-000060 | The Windows Server 2025 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireSignOrSeal Valu | |
| WN25-SO-000070 | Windows Server 2025 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: SealSecureChannel Valu | |
| WN25-SO-000080 | The Windows Server 2025 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: SignSecureChannel Valu | |
| WN25-SO-000090 | Windows Server 2025 computer account password must not be prevented from being reset. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: DisablePasswordChange | |
| WN25-SO-000100 | Windows Server 2025 maximum age for machine account passwords must be configured to 30 days or less. | This applies to member servers and stand-alone or nondomain-joined systems; it is not applicable for domain controllers. This is the default configuration for this setting (30 days). If the following registry value does not exist or is not | |
| WN25-SO-000110 | Windows Server 2025 must be configured to require a strong session key. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireStrongKey Value | |
| WN25-SO-000120 | Windows Server 2025 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: InactivityTimeoutS | |
| WN25-SO-000130 | The Windows Server 2025 required legal notice must be configured to display before console logon. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: LegalNoticeText Va | |
| WN25-SO-000150 | The Windows Server 2025 Smart Card removal option must be configured to Force Logoff or Lock Workstation. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: scremoveoption Value T | |
| WN25-SO-000160 | The Windows Server 2025 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: RequireSecuri | |
| WN25-SO-000170 | The Windows Server 2025 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: EnableSecurit | |
| WN25-SO-000180 | Windows Server 2025 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry HiveHKEY_LOCAL_MACHINE Registry Path\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value NameEnablePlainTextPass | |
| WN25-SO-000190 | The Windows Server 2025 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RequireSecuritySig | |
| WN25-SO-000200 | The Windows Server 2025 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: EnableSecuritySign | |
| WN25-SO-000210 | Windows Server 2025 must not allow anonymous SID/Name translation. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Network | |
| WN25-SO-000220 | Windows Server 2025 must not allow anonymous enumeration of Security Account Manager (SAM) accounts. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DW | |
| WN25-SO-000230 | Windows Server 2025 must not allow anonymous enumeration of shares. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value Type: REG_DWORD | |
| WN25-SO-000240 | Windows Server 2025 must be configured to prevent anonymous users from having the same permissions as the Everyone group. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: EveryoneIncludesAnonymous Value Type: R | |
| WN25-SO-000250 | Windows Server 2025 must restrict anonymous access to Named Pipes and Shares. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAc | |
| WN25-SO-000260 | Windows Server 2025 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\ Value Name: UseMachineId Type: REG_DWORD Value: 0x0 | |
| WN25-SO-000270 | Windows Server 2025 must prevent NTLM from falling back to a Null session. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ Value Name: allownullsessionfallback Type: R | |
| WN25-SO-000280 | Windows Server 2025 must prevent PKU2U authentication using online identities. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ Value Name: AllowOnlineID Type: REG_DWORD Val | |
| WN25-SO-000290 | Windows Server 2025 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ Value Name | |
| WN25-SO-000310 | Windows Server 2025 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value Type: REG_DW | |
| WN25-SO-000320 | Windows Server 2025 must be configured to at least negotiate signing for LDAP client signing. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ Value Name: LDAPClientIntegrity Value Type: REG_D | |
| WN25-SO-000330 | Windows Server 2025 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinClientSec Value Type: REG | |
| WN25-SO-000340 | Windows Server 2025 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinServerSec Value Type: REG | |
| WN25-SO-000350 | Windows Server 2025 users must be required to enter a password to access private keys stored on the computer. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ Value Name: ForceKeyProtection Type: REG_DWORD | |
| WN25-SO-000360 | Windows Server 2025 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ Value Name: Enabled Value Type: | |
| WN25-SO-000370 | Windows Server 2025 default permissions of global system objects must be strengthened. | If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ Value Name: ProtectionMode Value Type: | |
| WN25-SO-000380 | Windows Server 2025 User Account Control (UAC) approval mode for the built-in Administrator must be enabled. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-SO-000390 | Windows Server 2025 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-SO-000400 | Windows Server 2025 User Account Control (UAC) must, at a minimum, prompt administrators for consent on the secure desktop. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-SO-000410 | Windows Server 2025 User Account Control (UAC) must automatically deny standard user requests for elevation. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-SO-000420 | Windows Server 2025 User Account Control (UAC) must be configured to detect application installations and prompt for elevation. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-SO-000430 | Windows Server 2025 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-SO-000440 | Windows Server 2025 User Account Control (UAC) must run all administrators in Admin Approval Mode, enabling UAC. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-SO-000450 | Windows Server 2025 User Account Control (UAC) must virtualize file and registry write failures to per-user locations. | UAC requirements are not applicable for Server Core installations (this is the default installation option for Windows Server 2025 versus Server with Desktop Experience). If the following registry value does not exist or is not configured a | |
| WN25-UC-000010 | Windows Server 2025 must preserve zone information when saving attachments. | Note: This Check must be performed for each interactive user profile on the system. The default behavior is for Windows to mark file attachments with their zone information. If the registry Value Name below does not exist, this is not a fin | |
| WN25-UR-000010 | The Windows Server 2025 "Access Credential Manager as a trusted caller" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000020 | The Windows Server 2025 "Act as part of the operating system" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000030 | The Windows Server 2025 "Allow log on locally" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000040 | The Windows Server 2025 "Back up files and directories" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000050 | The Windows Server 2025 "Create a pagefile" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000060 | The Windows Server 2025 "Create a token object" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000070 | The Windows Server 2025 "Create global objects" user right must only be assigned to Administrators, Service, Local Service, and Network Service. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000080 | The Windows Server 2025 "Create permanent shared objects" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000090 | The Windows Server 2025 "Create symbolic links" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000100 | The Windows Server 2025 "Debug programs" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000110 | The Windows Server 2025 "Force shutdown from a remote system" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000120 | The Windows Server 2025 "Generate security audits" user right must only be assigned to Local Service and Network Service. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000130 | The Windows Server 2025 "Impersonate a client after authentication" user right must only be assigned to Administrators, Service, Local Service, and Network Service. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000140 | The Windows Server 2025 "Increase scheduling priority" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000150 | The Windows Server 2025 "Load and unload device drivers" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000160 | The Windows Server 2025 "Lock pages in memory" user right must not be assigned to any groups or accounts. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000170 | The Windows Server 2025 "Manage auditing and security log" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000180 | The Windows Server 2025 "Modify firmware environment values" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000190 | The Windows Server 2025 "Perform volume maintenance tasks" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000200 | The Windows Server 2025 "Profile single process" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000210 | The Windows Server 2025 "Restore files and directories" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or | |
| WN25-UR-000220 | The Windows Server 2025 "Take ownership of files or other objects" user right must only be assigned to the Administrators group. | Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or |
291 of 291.