Windows STIGs

CAT III 11

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

1. WN25-00-000180 CAT III V-278002 · SRG-OS-000080-GPOS-00048

   Windows Server 2025 nonadministrative accounts or groups must only have print permissions on printer shares.

   Maps to AC-3 via CCI-000213
   Check

   Open "Printers & scanners" in "Settings". If there are no printers configured, this is not applicable. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) For each printer: Select the printer and "Manage". Select "Printer Properties". Select the "Sharing" tab. If "Share this printer" is checked, select the "Security" tab. If any standard user accounts or groups have permissions other than "Print", this is a finding. The default is for the "Everyone" group to be given Print permission. "All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts.

   Fix

   Configure the permissions on shared printers to restrict standard users to only have Print permissions.

2. WN25-00-000440 CAT III V-278029 · SRG-OS-000355-GPOS-00143

   The Windows Server 2025 time service must synchronize with an appropriate DoW time source.

   Maps to SC-45, SC-45(1) via CCI-004923, CCI-004922
   Check

   Review the Windows time service configuration. Open an elevated command prompt (run as administrator). Enter "W32tm /query /configuration". Domain-joined systems (excluding the domain controller with the PDC emulator role): If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding. Other systems: If systems are configured with a "Type" of "NTP", including stand-alone or nondomain-joined systems and the domain controller with the PDC Emulator role, and do not have a DoW time server defined for "NTPServer", this is a finding. To determine the domain controller with the PDC Emulator role: Open PowerShell. Enter "Get-ADDomain | FT PDCEmulator".

   Fix

   Configure the system to synchronize time with an appropriate DoW time source. Domain-joined systems use NT5DS to synchronize time from other systems in the domain by default. If needed, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers. Change "Configure Windows NTP Client" to "Enabled" and configure the "NtpServer" field to point to an appropriate DoW time server. The US Naval Observatory operates stratum one-time servers, identified at https://www.usno.navy.mil/USNO/time/ntp/DOD-customers. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.

3. WN25-CC-000030 CAT III V-278082 · SRG-OS-000480-GPOS-00227

   Windows Server 2025 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.

   Maps to CM-6 via CCI-000366
   Check

   Verify the registry value below: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisableIPSourceRouting Type: REG_DWORD Value: 0x00000002 (2) If the registry value does not exist or is not configured as specified, this is a finding.

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) to "Enabled" with "Highest protection, source routing is completely disabled" selected. This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

4. WN25-CC-000040 CAT III V-278083 · SRG-OS-000480-GPOS-00227

   Windows Server 2025 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.

   Maps to CM-6 via CCI-000366
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: DisableIPSourceRouting Value Type: REG_DWORD Value: 0x00000002 (2)

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) to "Enabled" with "Highest protection, source routing is completely disabled" selected. This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

5. WN25-CC-000050 CAT III V-278084 · SRG-OS-000480-GPOS-00227

   Windows Server 2025 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.

   Maps to CM-6 via CCI-000366
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableICMPRedirect Value Type: REG_DWORD Value: 0x00000000 (0)

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes to "Disabled". This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

6. WN25-CC-000060 CAT III V-278085 · SRG-OS-000420-GPOS-00186

   Windows Server 2025 must be configured to ignore NetBIOS name release requests except from WINS servers.

   Maps to SC-5 via CCI-002385
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry HiveHKEY_LOCAL_MACHINE Registry Path\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ Value NameNoNameReleaseOnDemand Value TypeREG_DWORD Value0x00000001 (1)

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers to "Enabled". This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

7. WN25-CC-000200 CAT III V-278098 · SRG-OS-000095-GPOS-00049

   Windows Server 2025 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.

   Maps to CM-7 via CCI-000381
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ Value Name: DisableInventory Type: REG_DWORD Value: 0x00000001 (1)

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> Turn off Inventory Collector to "Enabled".

8. WN25-CC-000260 CAT III V-278104 · SRG-OS-000480-GPOS-00227

   Windows Server 2025 Windows Update must not obtain updates from other PCs on the internet.

   Maps to CM-6 via CCI-000366
   Check

   If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ Value Name: DODownloadMode Value Type: REG_DWORD Value: 0x00000000 (0) - No peering (HTTP Only) 0x00000001 (1) - Peers on same NAT only (LAN) 0x00000002 (2) - Local Network / Private group peering (Group) 0x00000063 (99) - Simple download mode, no peering (Simple) 0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) A value of 0x00000003 (3), internet, is a finding.

   Fix

   Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> Download Mode to "Enabled" with any option except "Internet" selected. Acceptable selections include: Bypass (100) Group (2) HTTP only (0) LAN (1) Simple (99)

9. WN25-CC-000320 CAT III V-278110 · SRG-OS-000480-GPOS-00227

   Windows Server 2025 Turning off File Explorer heap termination on corruption must be disabled.

   Maps to CM-6 via CCI-000366
   Check

   The default behavior is for File Explorer heap termination on corruption to be enabled. If the registry Value Name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoHeapTerminationOnCorruption Value Type: REG_DWORD Value: 0x00000000 (0) (or if the Value Name does not exist)

   Fix

   The default behavior is for File Explorer heap termination on corruption to be disabled. To correct this, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Turn off heap termination on corruption to "Not Configured" or "Disabled".

10. WN25-DC-000160 CAT III V-278147 · SRG-OS-000163-GPOS-00072

    Windows Server 2025 directory service must be configured to terminate LDAP-based network connections to the directory server after five minutes of inactivity.

    Maps to AC-12, SC-10 via CCI-001133, CCI-002361
    Check

    This applies to domain controllers. It is not applicable for other systems. Open an elevated command prompt (run as administrator). Enter "ntdsutil". At the "ntdsutil:" prompt, enter "LDAP policies". At the "ldap policy:" prompt, enter "connections". At the "server connections:" prompt, enter "connect to server [host-name]" (where [host-name] is the computer name of the domain controller). At the "server connections:" prompt, enter "q". At the "ldap policy:" prompt, enter "show values". If the value for MaxConnIdleTime is greater than "300" (5 minutes) or is not specified, this is a finding. Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit. Alternately, Dsquery can be used to display MaxConnIdleTime: Open "command prompt (Admin)". Enter the following command (on a single line). dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil). If the results do not specify a "MaxConnIdleTime" or it has a value greater than "300" (5 minutes), this is a finding.

    Fix

    Configure the directory service to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity. Open an elevated command prompt (run as administrator). Enter "ntdsutil". At the "ntdsutil:" prompt, enter "LDAP policies". At the "ldap policy:" prompt, enter "connections". At the "server connections:" prompt, enter "connect to server [host-name]" (where [host-name] is the computer name of the domain controller). At the "server connections:" prompt, enter "q". At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to 300". Enter "Commit Changes" to save. Enter "Show values" to verify changes. Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.

11. WN25-SO-000370 CAT III V-278231 · SRG-OS-000480-GPOS-00227

    Windows Server 2025 default permissions of global system objects must be strengthened.

    Maps to CM-6 via CCI-000366
    Check

    If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ Value Name: ProtectionMode Value Type: REG_DWORD Value: 0x00000001 (1)

    Fix

    Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links) to "Enabled".