Windows STIGs

CAT III 15

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

1. WN11-00-000065 CAT III V-288812 · SRG-OS-000118-GPOS-00060

   Unused accounts must be disabled or removed from the system after 35 days of inactivity.

   Maps to AC-2(3) via CCI-000017
   Check

   Run "PowerShell". Copy the lines below to the PowerShell window and enter. "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.LastLogin.Value $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 if ($lastLogin -eq $null) { $lastLogin = 'Never' } Write-Host $user.Name $lastLogin $enabled }" This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). For example: User1 10/31/2025 5:49:56 AM True Review the list to determine the finding validity for each account reported. Exclude the following accounts: Built-in administrator account (SID ending in 500) Built-in guest account (SID ending in 501) Built-in DefaultAccount (SID ending in 503) Local administrator account If any enabled accounts have not been logged on to within the past 35 days, this is a finding. Inactive accounts that have been reviewed and deemed to be required must be documented with the information system security officer (ISSO).

   Fix

   Review local accounts and verify their necessity. Disable or delete any active accounts that have not been used in the last 35 days.

2. WN11-00-000085 CAT III V-253272 · SRG-OS-000480-GPOS-00227

   Standard local user accounts must not exist on a system in a domain.

   Maps to CM-6 via CCI-000366
   Check

   Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. If local users other than the accounts listed below exist on a workstation in a domain, this is a finding. The accounts listed assumes a system is joined to a domain and thus (per best practice), the local default accounts have been disabled. For standalone or nondomain-joined systems, this is Not Applicable. Built-in guest account (SID ending in 501) Built-in DefaultAccount (SID ending in 503) Built-in defaultuser0 (*SID unique per workstation) Built-in WDAGUtilityAccount (SID ending in 504) Local administrator account(s) * Note: The SID for defaultuser0 is machine-specific and immutable (cannot be changed). It will differ per Windows installation. Some of the built-in accounts may not exist on a system, depending on the Windows 11 version. Refer to WN11-SO-000280 for requirement/guidance in use of Windows LAPS to manage the built-in administrator account password.

   Fix

   Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts.

3. WN11-00-000260 CAT III V-253296 · SRG-OS-000355-GPOS-00143

   The Windows 11 time service must synchronize with an appropriate DoW time source.

   Maps to AU-8(1), SC-45(1) via CCI-004923, CCI-001891
   Check

   Review the Windows time service configuration. Open an elevated "Command Prompt" (run as administrator). Enter "W32tm /query /configuration". Domain-joined systems (excluding the domain controller with the PDC emulator role): If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding.

   Fix

   Configure the system to synchronize time with an appropriate DoW time source. Domain-joined systems use NT5DS to synchronize time from other systems in the domain by default. If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an appropriate DoW time server. The US Naval Observatory operates stratum 1 time servers, identified at https://www.cnmoc.usff.navy.mil/Our-Commands/United-States-Naval-Observatory/Precise-Time-Department/Network-Time-Protocol-NTP/. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.

4. WN11-CC-000030 CAT III V-253355 · SRG-OS-000480-GPOS-00227

   The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.

   Maps to CM-6 via CCI-000366
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableICMPRedirect Value Type: REG_DWORD Value: 0

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

5. WN11-CC-000035 CAT III V-253356 · SRG-OS-000420-GPOS-00186

   The system must be configured to ignore NetBIOS name release requests except from WINS servers.

   Maps to SC-5 via CCI-002385
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ Value Name: NoNameReleaseOnDemand Value Type: REG_DWORD Value: 1

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

6. WN11-CC-000170 CAT III V-253384 · SRG-OS-000480-GPOS-00227

   The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.

   Maps to CM-6 via CCI-000366
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: MSAOptional Value Type: REG_DWORD Value: 0x00000001 (1)

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Runtime >> "Allow Microsoft accounts to be optional" to "Enabled".

7. WN11-CC-000175 CAT III V-253385 · SRG-OS-000095-GPOS-00049

   The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.

   Maps to CM-7 via CCI-000381
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ Value Name: DisableInventory Value Type: REG_DWORD Value: 1

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> "Turn off Inventory Collector" to "Enabled".

8. WN11-CC-000206 CAT III V-253394 · SRG-OS-000480-GPOS-00227

   Windows Update must not obtain updates from other PCs on the internet.

   Maps to CM-6 via CCI-000366
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ Value Type: REG_DWORD Value: 0x00000000 (0) - No peering (HTTP Only) 0x00000001 (1) - Peers on same NAT only (LAN) 0x00000002 (2) - Local Network / Private group peering (Group) 0x00000063 (99) - Simple download mode, no peering (Simple) 0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) A value of 0x00000003 (3), Internet, is a finding. Standalone systems (configured in Settings): If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\ Value Name: DODownloadMode Value Type: REG_DWORD Value: 0x00000000 (0) - Off 0x00000001 (1) - LAN

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> "Download Mode" to "Enabled" with any option except "Internet" selected. Acceptable selections include: Bypass (100) Group (2) HTTP only (0) LAN (1) Simple (99)

9. WN11-CC-000220 CAT III V-253397 · SRG-OS-000420-GPOS-00186

   File Explorer heap termination on corruption must be disabled.

   Maps to SC-5 via CCI-002385
   Check

   The default behavior is for File Explorer heap termination on corruption to be enabled. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoHeapTerminationOnCorruption Value Type: REG_DWORD Value: 0x00000000 (0) (or if the Value Name does not exist)

   Fix

   The default behavior is for File Explorer heap termination on corruption to be enabled. To correct this, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off heap termination on corruption" to "Not Configured" or "Disabled".

10. WN11-CC-000390 CAT III V-253425 · SRG-OS-000095-GPOS-00049

    Windows 11 must be configured to prevent users from receiving suggestions for third-party or additional applications.

    Maps to CM-7 via CCI-000381
    Check

    Note: This Check must be performed for each interactive user profile on the system. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CloudContent\ Value Name: DisableThirdPartySuggestions Type: REG_DWORD Value: 0x00000001 (1) Note: This requirement is applicable to profiles for interactive logins. It is not applicable for Service accounts. To determine the system's enabled user profiles: Run "PowerShell" as an administrator. Execute the following command: Get-LocalUser | Where-Object {$_.Enabled -eq $true}

    Fix

    For each user profile on the system, configure the policy value for User Configuration >> Administrative Templates. >> Windows Components >> Cloud Content >> "Do not suggest third-party content in Windows spotlight" to "Enabled".

11. WN11-SO-000050 CAT III V-253441 · SRG-OS-000480-GPOS-00227

    The computer account password must not be prevented from being reset.

    Maps to CM-6 via CCI-000366
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: DisablePasswordChange Value Type: REG_DWORD Value: 0

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Disable machine account password changes" to "Disabled".

12. WN11-SO-000055 CAT III V-253442 · SRG-OS-000480-GPOS-00227

    The maximum age for machine account passwords must be configured to 30 days or less.

    Maps to CM-6 via CCI-000366
    Check

    (remove)This is the default configuration for this setting (30 days). If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: MaximumPasswordAge Value Type: REG_DWORD Value: 0x0000001e (30) (or less, excluding 0)

    Fix

    This is the default configuration for this setting (30 days). Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Maximum machine account password age" to "30" or less (excluding 0 which is unacceptable).

13. WN11-SO-000085 CAT III V-253447 · SRG-OS-000480-GPOS-00227

    Caching of logon credentials must be limited.

    Maps to CM-6 via CCI-000366
    Check

    This is the default configuration for this setting (10 logons to cache). If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: CachedLogonsCount Value Type: REG_SZ Value: 10 (or less) This setting only applies to domain-joined systems, however, it is configured by default on all systems.

    Fix

    This is the default configuration for this setting (10 logons to cache). Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Number of previous logons to cache (in case domain controller is not available)" to "10" logons or less. This setting only applies to domain-joined systems, however, it is configured by default on all systems.

14. WN11-SO-000240 CAT III V-253467 · SRG-OS-000480-GPOS-00227

    The default permissions of global system objects must be increased.

    Maps to CM-6 via CCI-000366
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ Value Name: ProtectionMode Value Type: REG_DWORD Value: 1

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links)" to "Enabled".

15. WN11-UC-000015 CAT III V-253477 · SRG-OS-000095-GPOS-00049

    Toast notifications to the lock screen must be turned off.

    Maps to CM-7 via CCI-000381
    Check

    Note: This Check must be performed for each interactive user profile on the system. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications\ Value Name: NoToastApplicationNotificationOnLockScreen Value Type: REG_DWORD Value: 1 Note: This requirement is applicable to profiles for interactive logins. It is not applicable for Service accounts. To determine the system's enabled user profiles: Run "PowerShell" as an administrator. Execute the following command: Get-LocalUser | Where-Object {$_.Enabled -eq $true}

    Fix

    For each user profile on the system, configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> "Turn off toast notifications on the lock screen" to "Enabled".