Windows STIGs

CAT I 27

Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.

1. WN11-00-000030 CAT I V-253259 · SRG-OS-000404-GPOS-00183

   Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.

   Maps to SC-28(1) via CCI-002475
   Check

   For AVD implementations with no data at rest, this is NA. Verify all Windows 11 information systems (including SIPRNet) employ BitLocker for full disk encryption. If full disk encryption using BitLocker is not implemented, this is a finding. Verify BitLocker is turned on for the operating system drive and any fixed data drives. Open "BitLocker Drive Encryption" from the Control Panel. If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding. Note: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN11-00-000031 and WN11-00-000032).

   Fix

   Enable full disk encryption on all information systems (including SIPRNet) using BitLocker. BitLocker, included in Windows, can be enabled in the Control Panel under "BitLocker Drive Encryption" as well as other management tools. Note: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN11-00-000031 and WN11-00-000032).

2. WN11-00-000031 CAT I V-253260 · SRG-OS-000405-GPOS-00184

   Windows 11 systems must use a BitLocker PIN for pre-boot authentication.

   Maps to SC-28(1) via CCI-002476
   Check

   For AVD implementations with no data at rest, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\FVE\ Value Name: UseAdvancedStartup Type: REG_DWORD Value: 0x00000001 (1) If one of the following registry values does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\FVE\ Value Name: UseTPMPIN Type: REG_DWORD Value: 0x00000001 (1) Value Name: UseTPMKeyPIN Type: REG_DWORD Value: 0x00000001 (1) When BitLocker network unlock is used: Value Name: UseTPMPIN Type: REG_DWORD Value: 0x00000002 (2) Value Name: UseTPMKeyPIN Type: REG_DWORD Value: 0x00000002 (2) BitLocker network unlock may be used in conjunction with a BitLocker PIN. Refer to the article below regarding information about network unlock. https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives "Require additional authentication at startup" to "Enabled" with "Configure TPM Startup PIN:" set to "Require startup PIN with TPM" or with "Configure TPM startup key and PIN:" set to "Require startup key and PIN with TPM". If Network Unlock is active, select "Configure TPM startup PIN:" and set to "Require startup PIN with TPM". If Network Unlock is not active, select "Configure TPM startup key and PIN:" and set to "Require startup key and PIN with TPM".

3. WN11-00-000040 CAT I V-253263 · SRG-OS-000480-GPOS-00227

   Windows 11 systems must be maintained at a supported servicing level.

   Maps to CM-6 via CCI-000366
   Check

   1. Determine your Windows 11 OS version. a. Run "winver.exe". The "About Windows" dialog box will display the system's version and OS build. For example, "Microsoft Windows 11 Version 24H2 (OS Build 26100.8875)". Record the numbers observed. 2. Determine the system's latest installed security patch. a. Open "PowerShell" with elevated privileges (run as administrator). b. Enter the following: Get-HotFix -Description "Security Update" c. Record the "InstalledOn" date and the KB numbers listed under the "HotFixID" column in the resulting display. 3. Determine Microsoft's Support timeframe for the system's Windows 11 OS version. a. Access Microsoft's Lifecycle & Build History website at https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information. b. Review the table listing the "Windows 11 current versions by servicing option" to find the end-of-support date corresponding to the system's OS version. This date marks the official deadline after which Microsoft stops providing software support (or security updates) for that operating system version. The Windows 11 current versions are categorized by servicing option. For example, (as of Aug 2026) under the General Availability Channel for Enterprise version 25H, the last date for (support) updates is 2028-10-10, and the latest build is 26200.9168. Similar data is provided for the Enterprise LTSC releases. c. Review (on the same page) a table listing "Windows 11 release history" data for OS hotpatch updates. Compare the system's OS build and KB # (from step 1 and 2) with those listed to determine how many (if any) newer patches are available for the system's OS version. It is strongly recommended that the latest security patch be installed, unless there is a valid operational reason to delay installing it. If the end-of-support date for the system's OS version (from step 3b) is a past date, this is a finding.

   Fix

   Determine if the end-of-support date for the system's OS build (from Microsoft's Windows 11 release history website) is a past date. If the end-of-support date for the system's OS build is in the past, perform an update to an OS build whose end-of-support date is a future date.

4. WN11-00-000045 CAT I V-253264 · SRG-OS-000480-GPOS-00227

   The Windows 11 system must use an antivirus program.

   Maps to CM-6 via CCI-000366
   Check

   Verify an organizationally approved antivirus solution (Microsoft Defender Antivirus, for example) is installed on the system and in use. Verify if Microsoft Defender Antivirus is in use or enabled: If Windows Defender is your primary or secondary antivirus (AV) application, this command will use the built-in Microsoft Defender module to retrieve granular engine data. Run "PowerShell" as an administrator. Execute the following command: Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled, AntivirusEnabled, AMEngineVersion Review the resulting display. Note the text under "AMRunningMode". This reveals how Defender is coexisting with other AV software. "Normal" indicates Defender is active and acting as the primary AV software. "Passive" indicates another compatible third-party AV software is registered and active. Defender can still provide auxiliary scanning. "EDR Block Mode" indicates Defender is executing in Passive Mode along with a third-party AV to actively block and remediate malicious files if the primary AV misses them. Review the text under heading of "RealTimeProtectionEnabled". A value of "True" or "False" indicates whether (or not) Defender is active (currently running). Verify third-party antivirus is in use or enabled: Note: This command will display all AV applications registered with the Windows Security Center (including third-party applications). Run "PowerShell" as an administrator. Execute the following command: Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName, productState, pathToSignedProductExe Review the resulting display. Note the text under "displayName". This will indicate the currently running AV applications. The "productState" returns an integer value that reveals whether the AV is active, disabled, or up-to-date. The value of "397568" indicates it is active and up-to-date. The value of "397584 indicates it is active, but out of date (signature updates required). The value of "393472" indicates disabled and up-to-date (AV installed, but not active). The value of "393488" indicates disabled and out of date. If there is no antivirus solution installed and active on the system, this is a finding.

   Fix

   Install and activate Microsoft Defender Antivirus or a third-party antivirus solution.

5. WN11-00-000050 CAT I V-253265 · SRG-OS-000080-GPOS-00048

   Local volumes must be formatted using NTFS.

   Maps to AC-3 via CCI-000213
   Check

   Run "Computer Management". Navigate to Storage >> Disk Management. If the "File System" column does not indicate "NTFS" for each volume assigned a drive letter, this is a finding. This does not apply to system partitions such the Recovery and EFI System Partition.

   Fix

   Format all local volumes to use NTFS.

6. WN11-00-000070 CAT I V-253269 · SRG-OS-000312-GPOS-00123

   Only accounts responsible for the administration of a system must have Administrator rights on the system.

   Maps to AC-3(4) via CCI-002165
   Check

   Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. Standard user accounts must not be members of the local administrator group. If prohibited accounts are members of the local administrators group, this is a finding. The built-in Administrator account or other required administrative accounts would not be a finding.

   Fix

   Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. Remove any standard user accounts.

7. WN11-00-000100 CAT I V-253275 · SRG-OS-000095-GPOS-00049

   Internet Information System (IIS) or its subcomponents must not be installed on a workstation.

   Maps to CM-7 via CCI-000381
   Check

   Verify it has not been installed on the system. Run "Programs and Features". Select "Turn Windows features on or off". If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, this is a finding. If an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO. In addition, any applicable requirements from the IIS STIG must be addressed.

   Fix

   Uninstall "Internet Information Services" or "Internet Information Services Hostable Web Core" from the system.

8. WN11-00-000150 CAT I V-253284 · SRG-OS-000433-GPOS-00192

   Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.

   Maps to SI-16 via CCI-002824
   Check

   Verify SEHOP is turned on. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\kernel\ Value Name: DisableExceptionChainValidation Value Type: REG_DWORD Value: 0x00000000 (0)

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Enable Structured Exception Handling Overwrite Protection (SEHOP)" to "Enabled". This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

9. WN11-00-000240 CAT I V-253294 · SRG-OS-000480-GPOS-00227

   Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.

   Maps to CM-6 via CCI-000366
   Check

   Determine whether administrative accounts are prevented from using applications that access the internet, such as web browsers, or with potential internet sources, such as email, except as necessary for local service administration. The organization must have a policy that prohibits administrative accounts from using applications that access the internet, such as web browsers, or with potential internet sources, such as email, except as necessary for local service administration. The policy must define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. Technical measures such as the removal of applications or application allowlisting must be used where feasible to prevent the use of applications that access the internet. If accounts with administrative privileges are not prevented from using applications that access the internet or with potential internet sources, this is a finding.

   Fix

   Establish and enforce a policy that prohibits administrative accounts from using applications that access the internet, such as web browsers, or with potential internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. Implement technical measures where feasible such as removal of applications or use of application allowlisting to restrict the use of applications that can access the internet.

10. WN11-AC-000045 CAT I V-253305 · SRG-OS-000073-GPOS-00041

    Reversible password encryption must be disabled.

    Maps to IA-5(1) via CCI-004062, CCI-000196
    Check

    Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding.

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled".

11. WN11-CC-000075 CAT I V-253370 · SRG-OS-000480-GPOS-00227

    Credential Guard must be running on Windows 11 systems.

    Maps to CM-6 via CCI-000366
    Check

    Confirm Credential Guard is running. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. Alternately: Run "System Information". Under "System Summary", verify the following: If "virtualization-based Services Running" does not list "Credential Guard", this is a finding. The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ Value Name: LsaCfgFlags Value Type: REG_DWORD Value: 0x00000001 (1) (Enabled with UEFI lock)

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On virtualization-based Security" to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration:". A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard

12. WN11-CC-000155 CAT I V-253382 · SRG-OS-000138-GPOS-00069

    Solicited Remote Assistance must not be allowed.

    Maps to SC-4 via CCI-001090
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowToGetHelp Value Type: REG_DWORD Value: 0

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Assistance >> "Configure Solicited Remote Assistance" to "Disabled".

13. WN11-CC-000180 CAT I V-253386 · SRG-OS-000368-GPOS-00154

    Autoplay must be turned off for non-volume devices.

    Maps to CM-7(2) via CCI-001764
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value Type: REG_DWORD Value: 1

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices" to "Enabled".

14. WN11-CC-000185 CAT I V-253387 · SRG-OS-000368-GPOS-00154

    The default autorun behavior must be configured to prevent autorun commands.

    Maps to CM-7(2) via CCI-001764
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value Type: REG_DWORD Value: 1

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun" to "Enabled:Do not execute any autorun commands".

15. WN11-CC-000190 CAT I V-253388 · SRG-OS-000368-GPOS-00154

    Autoplay must be disabled for all drives.

    Maps to CM-7(2) via CCI-001764
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value Type: REG_DWORD Value: 0x000000ff (255) Note: If the value for NoDriveTypeAutorun is entered manually, it must be entered as "ff" when Hexadecimal is selected, or "255" with Decimal selected. Using the policy value specified in the Fix section will enter it correctly.

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay" to "Enabled:All Drives".

16. WN11-CC-000315 CAT I V-253411 · SRG-OS-000362-GPOS-00149

    The Windows Installer feature "Always install with elevated privileges" must be disabled.

    Maps to CM-11(2) via CCI-003980, CCI-001812
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value Type: REG_DWORD Value: 0

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".

17. WN11-CC-000330 CAT I V-253416 · SRG-OS-000125-GPOS-00065

    The Windows Remote Management (WinRM) client must not use Basic authentication.

    Maps to MA-4 via CCI-000877
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value Type: REG_DWORD Value: 0

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled".

18. WN11-CC-000345 CAT I V-253418 · SRG-OS-000125-GPOS-00065

    The Windows Remote Management (WinRM) service must not use Basic authentication.

    Maps to MA-4 via CCI-000877
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value Type: REG_DWORD Value: 0

    Fix

    Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled". Severity Override Guidance: The AO can allow the severity override if they have reviewed the overall protection. This would only be allowed temporarily for implementation as documented and approved. .... Allowing Basic authentication to be used for the sole creation of Office 365 DoD tenants. .... A documented mechanism and or script that can disable Basic authentication once administration completes. .... Use of a Privileged Access Workstation (PAW) and adherence to the Clean Source principle for administration.

19. WN11-SO-000140 CAT I V-253452 · SRG-OS-000480-GPOS-00227

    Anonymous SID/Name translation must not be allowed.

    Maps to CM-6 via CCI-000366
    Check

    Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation" to "Disabled".

20. WN11-SO-000145 CAT I V-253453 · SRG-OS-000480-GPOS-00227

    Anonymous enumeration of SAM accounts must not be allowed.

    Maps to CM-6 via CCI-000366
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DWORD Value: 1

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".

21. WN11-SO-000150 CAT I V-253454 · SRG-OS-000138-GPOS-00069

    Anonymous enumeration of shares must be restricted.

    Maps to SC-4 via CCI-001090
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value Type: REG_DWORD Value: 1

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".

22. WN11-SO-000165 CAT I V-253456 · SRG-OS-000138-GPOS-00069

    Anonymous access to Named Pipes and Shares must be restricted.

    Maps to SC-4 via CCI-001090
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value Type: REG_DWORD Value: 1

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".

23. WN11-SO-000195 CAT I V-253461 · SRG-OS-000073-GPOS-00041

    The system must be configured to prevent the storage of the LAN Manager hash of passwords.

    Maps to IA-5(1) via CCI-004062, CCI-000196
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value Type: REG_DWORD Value: 1

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".

24. WN11-SO-000205 CAT I V-253462 · SRG-OS-000480-GPOS-00227

    The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.

    Maps to CM-6 via CCI-000366
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value Type: REG_DWORD Value: 5

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".

25. WN11-UR-000015 CAT I V-253481 · SRG-OS-000324-GPOS-00125

    The "Act as part of the operating system" user right must not be assigned to any groups or accounts.

    Maps to AC-6(10) via CCI-002235
    Check

    Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or accounts (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding.

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).

26. WN11-UR-000045 CAT I V-253486 · SRG-OS-000324-GPOS-00125

    The "Create a token object" user right must not be assigned to any groups or accounts.

    Maps to AC-6(10) via CCI-002235
    Check

    Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or accounts are granted the "Create a token object" user right, this is a finding.

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).

27. WN11-UR-000065 CAT I V-253490 · SRG-OS-000324-GPOS-00125

    The "Debug programs" user right must only be assigned to the Administrators group.

    Maps to AC-6(10) via CCI-002235
    Check

    Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or accounts other than the following are granted the "Debug Programs" user right, this is a finding: Administrators

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to only include the following groups or accounts: Administrators