DISA_STIG_Microsoft_Windows_Server_2019_v3r7.audit from DISA Microsoft Windows Server 2019 STIG v3r7

WN19-00-000010 - Windows Server 2019 users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.

CAT|I

CCI|CCI-000366

Rule-ID|SV-205844r991589_rule

STIG-ID|WN19-00-000010

STIG-Legacy|SV-103457

STIG-Legacy|V-93369

Vuln-ID|V-205844

WN19-00-000020 - Windows Server 2019 passwords for the built-in Administrator account must be changed at least every 60 days.

CAT|II

CCI|CCI-000199

CCI|CCI-004066

Rule-ID|SV-205657r1153431_rule

STIG-ID|WN19-00-000020

STIG-Legacy|SV-103559

STIG-Legacy|V-93473

Vuln-ID|V-205657

WN19-00-000030 - Windows Server 2019 administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.

Rule-ID|SV-205845r991589_rule

STIG-ID|WN19-00-000030

STIG-Legacy|SV-103293

STIG-Legacy|V-93205

Vuln-ID|V-205845

WN19-00-000040 - Windows Server 2019 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.

Rule-ID|SV-205846r991589_rule

STIG-ID|WN19-00-000040

STIG-Legacy|SV-103295

STIG-Legacy|V-93207

Vuln-ID|V-205846

WN19-00-000050 - Windows Server 2019 manually managed application account passwords must be at least 14 characters in length.

CCI|CCI-000205

Rule-ID|SV-205661r1051068_rule

STIG-ID|WN19-00-000050

STIG-Legacy|SV-103547

STIG-Legacy|V-93461

Vuln-ID|V-205661

WN19-00-000060 - Windows Server 2019 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Rule-ID|SV-205847r991589_rule

STIG-ID|WN19-00-000060

STIG-Legacy|SV-103297

STIG-Legacy|V-93209

Vuln-ID|V-205847

WN19-00-000070 - Windows Server 2019 shared user accounts must not be permitted.

CCI|CCI-000764

Rule-ID|SV-205699r958482_rule

STIG-ID|WN19-00-000070

STIG-Legacy|SV-103523

STIG-Legacy|V-93437

Vuln-ID|V-205699

WN19-00-000080 - Windows Server 2019 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

CCI|CCI-001774

Rule-ID|SV-205807r958808_rule

STIG-ID|WN19-00-000080

STIG-Legacy|SV-103465

STIG-Legacy|V-93379

Vuln-ID|V-205807

WN19-00-000090 - Windows Server 2019 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.

Rule-ID|SV-205848r991589_rule

STIG-ID|WN19-00-000090

STIG-Legacy|SV-103301

STIG-Legacy|V-93213

Vuln-ID|V-205848

WN19-00-000100 - Windows Server 2019 must be maintained at a supported servicing level.

Rule-ID|SV-205849r991589_rule

STIG-ID|WN19-00-000100

STIG-Legacy|SV-103303

STIG-Legacy|V-93215

Vuln-ID|V-205849

WN19-00-000110 - Windows Server 2019 must use an anti-virus program.

Rule-ID|SV-205850r991589_rule

STIG-ID|WN19-00-000110

STIG-Legacy|SV-103305

STIG-Legacy|V-93217

Vuln-ID|V-205850

WN19-00-000120 - Windows Server 2019 must have a host-based intrusion detection or prevention system.

Rule-ID|SV-205851r991589_rule

STIG-ID|WN19-00-000120

STIG-Legacy|SV-103307

STIG-Legacy|V-93219

Vuln-ID|V-205851

WN19-00-000130 - Windows Server 2019 local volumes must use a format that supports NTFS attributes.

CCI|CCI-000213

Rule-ID|SV-205663r1137691_rule

STIG-ID|WN19-00-000130

STIG-Legacy|SV-103079

STIG-Legacy|V-92991

Vuln-ID|V-205663

WN19-00-000140 - Windows Server 2019 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.

CCI|CCI-002165

Rule-ID|SV-205734r958702_rule

STIG-ID|WN19-00-000140

STIG-Legacy|SV-103107

STIG-Legacy|V-93019

Vuln-ID|V-205734

WN19-00-000150 - Windows Server 2019 permissions for program file directories must conform to minimum requirements.

Rule-ID|SV-205735r958702_rule

STIG-ID|WN19-00-000150

STIG-Legacy|SV-103109

STIG-Legacy|V-93021

Vuln-ID|V-205735

WN19-00-000160 - Windows Server 2019 permissions for the Windows installation directory must conform to minimum requirements.

Rule-ID|SV-205736r1016383_rule

STIG-ID|WN19-00-000160

STIG-Legacy|SV-103111

STIG-Legacy|V-93023

Vuln-ID|V-205736

WN19-00-000170 - Windows Server 2019 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.

CCI|CCI-002235

Rule-ID|SV-205737r1153434_rule

STIG-ID|WN19-00-000170

STIG-Legacy|SV-103113

STIG-Legacy|V-93025

Vuln-ID|V-205737

WN19-00-000180 - Windows Server 2019 non-administrative accounts or groups must only have print permissions on printer shares.

CAT|III

Rule-ID|SV-205664r1137691_rule

STIG-ID|WN19-00-000180

STIG-Legacy|SV-103081

STIG-Legacy|V-92993

Vuln-ID|V-205664

WN19-00-000190 - Windows Server 2019 outdated or unused accounts must be removed or disabled.

CCI|CCI-000795

CCI|CCI-003627

Rule-ID|SV-205707r1051076_rule

STIG-ID|WN19-00-000190

STIG-Legacy|SV-103543

STIG-Legacy|V-93457

Vuln-ID|V-205707

WN19-00-000200 - Windows Server 2019 accounts must require passwords.

Rule-ID|SV-205700r958482_rule

STIG-ID|WN19-00-000200

STIG-Legacy|SV-103525

STIG-Legacy|V-93439

Vuln-ID|V-205700

WN19-00-000210 - Windows Server 2019 passwords must be configured to expire.

Rule-ID|SV-205658r1051066_rule

STIG-ID|WN19-00-000210

STIG-Legacy|SV-103561

STIG-Legacy|V-93475

Vuln-ID|V-205658

WN19-00-000220 - Windows Server 2019 system files must be monitored for unauthorized changes.

CCI|CCI-001744

Rule-ID|SV-205803r958794_rule

STIG-ID|WN19-00-000220

STIG-Legacy|SV-103291

STIG-Legacy|V-93203

Vuln-ID|V-205803

WN19-00-000230 - Windows Server 2019 non-system-created file shares must limit access to groups that require it.

CCI|CCI-001090

Rule-ID|SV-205721r1137695_rule

STIG-ID|WN19-00-000230

STIG-Legacy|SV-103617

STIG-Legacy|V-93531

Vuln-ID|V-205721

WN19-00-000240 - Windows Server 2019 must have software certificate installation files removed.

Rule-ID|SV-205852r991589_rule

STIG-ID|WN19-00-000240

STIG-Legacy|SV-103309

STIG-Legacy|V-93221

Vuln-ID|V-205852

WN19-00-000250 - Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-205727r958552_rule

STIG-ID|WN19-00-000250

STIG-Legacy|SV-103601

STIG-Legacy|V-93515

Vuln-ID|V-205727

WN19-00-000260 - Windows Server 2019 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-205829r958912_rule

STIG-ID|WN19-00-000260

STIG-Legacy|SV-103629

STIG-Legacy|V-93543

Vuln-ID|V-205829

WN19-00-000270 - Windows Server 2019 must have the roles and features required by the system documented.

CCI|CCI-000381

Rule-ID|SV-205677r958478_rule

STIG-ID|WN19-00-000270

STIG-Legacy|SV-103467

STIG-Legacy|V-93381

Vuln-ID|V-205677

WN19-00-000280 - Windows Server 2019 must have a host-based firewall installed and enabled.

CCI|CCI-002080

Rule-ID|SV-214936r991589_rule

STIG-ID|WN19-00-000280

STIG-Legacy|SV-103657

STIG-Legacy|V-93571

Vuln-ID|V-214936

WN19-00-000290 - Windows Server 2019 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where Endpoint Security Solution (ESS) is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).

Rule-ID|SV-205728r1000127_rule

STIG-ID|WN19-00-000290

STIG-Legacy|SV-103653

STIG-Legacy|V-93567

Vuln-ID|V-205728

WN19-00-000300 - Windows Server 2019 must automatically remove or disable temporary user accounts after 72 hours.

CCI|CCI-000016

Rule-ID|SV-205624r958364_rule

Detections

Analytics

DISA Microsoft Windows Server 2019 STIG v3r7

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update


Revision 1.2 Apr 24, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 25, 2026 Functional Update WN19-00-000440 - The Windows Server 2019 time service must synchronize with an appropriate DOD time source. WN19-00-000460 - Windows Server 2019 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.