Detections
Analytics

DISA Microsoft Windows Server 2022 STIG v2r4

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: DISA Microsoft Windows Server 2022 STIG v2r4

Updated: 10/22/2025

Authority: DISA STIG

Plugin: Windows

Revision: 1.4

Estimated Item Count: 276

File Details

Filename: DISA_STIG_Microsoft_Windows_Server_2022_v2r4.audit

Size: 623 kB

MD5: d404c225ac203e30f4f3b9dd8a7fa801
SHA256: 3d579b52dae1c20166869b0c92060ff731036d3e43aa5f735a9a3facf5727f0c

Audit Items

DescriptionCategories
DISA_Microsoft_Windows_Server_2022_STIG_v2r4.audit from DISA Microsoft Windows Server 2022 STIG v2r4
WN22-00-000010 - Windows Server 2022 users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.
WN22-00-000020 - Windows Server 2022 passwords for the built-in Administrator account must be changed at least every 60 days.
WN22-00-000030 - Windows Server 2022 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.
WN22-00-000040 - Windows Server 2022 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.
WN22-00-000050 - Windows Server 2022 manually managed application account passwords must be at least 14 characters in length.
WN22-00-000060 - Windows Server 2022 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.
WN22-00-000070 - Windows Server 2022 shared user accounts must not be permitted.
WN22-00-000080 - Windows Server 2022 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
WN22-00-000090 - Windows Server 2022 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.
WN22-00-000100 - Windows Server 2022 must be maintained at a supported servicing level.
WN22-00-000110 - Windows Server 2022 must use an antivirus program.
WN22-00-000120 - Windows Server 2022 must have a host-based intrusion detection or prevention system.
WN22-00-000130 - Windows Server 2022 local volumes must use a format that supports NTFS attributes.
WN22-00-000140 - Windows Server 2022 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.
WN22-00-000150 - Windows Server 2022 permissions for program file directories must conform to minimum requirements.
WN22-00-000160 - Windows Server 2022 permissions for the Windows installation directory must conform to minimum requirements.
WN22-00-000170 - Windows Server 2022 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
WN22-00-000180 - Windows Server 2022 nonadministrative accounts or groups must only have print permissions on printer shares.
WN22-00-000190 - Windows Server 2022 outdated or unused accounts must be removed or disabled.
WN22-00-000200 - Windows Server 2022 accounts must require passwords.
WN22-00-000210 - Windows Server 2022 passwords must be configured to expire.
WN22-00-000220 - Windows Server 2022 system files must be monitored for unauthorized changes.
WN22-00-000230 - Windows Server 2022 nonsystem-created file shares must limit access to groups that require it.
WN22-00-000240 - Windows Server 2022 must have software certificate installation files removed.
WN22-00-000250 - Windows Server 2022 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
WN22-00-000260 - Windows Server 2022 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.
WN22-00-000270 - Windows Server 2022 must have the roles and features required by the system documented.
WN22-00-000280 - Windows Server 2022 must have a host-based firewall installed and enabled.
WN22-00-000290 - Windows Server 2022 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where Endpoint Security Solution (ESS) is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).
WN22-00-000300 - Windows Server 2022 must automatically remove or disable temporary user accounts after 72 hours.
WN22-00-000310 - Windows Server 2022 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.
WN22-00-000320 - Windows Server 2022 must not have the Fax Server role installed.
WN22-00-000330 - Windows Server 2022 must not have the Microsoft FTP service installed unless required by the organization.
WN22-00-000340 - Windows Server 2022 must not have the Peer Name Resolution Protocol installed.
WN22-00-000350 - Windows Server 2022 must not have Simple TCP/IP Services installed.
WN22-00-000360 - Windows Server 2022 must not have the Telnet Client installed.
WN22-00-000370 - Windows Server 2022 must not have the TFTP Client installed.
WN22-00-000380 - Windows Server 2022 must not the Server Message Block (SMB) v1 protocol installed.
WN22-00-000390 - Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
WN22-00-000400 - Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
WN22-00-000410 - Windows Server 2022 must not have Windows PowerShell 2.0 installed.
WN22-00-000420 - Windows Server 2022 FTP servers must be configured to prevent anonymous logons.
WN22-00-000430 - Windows Server 2022 FTP servers must be configured to prevent access to the system drive.
WN22-00-000440 - The Windows Server 2022 time service must synchronize with an appropriate DOD time source.
WN22-00-000450 - Windows Server 2022 must have orphaned security identifiers (SIDs) removed from user rights.
WN22-00-000460 - Windows Server 2022 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.
WN22-00-000470 - Windows Server 2022 must have Secure Boot enabled.
WN22-AC-000010 - Windows Server 2022 account lockout duration must be configured to 15 minutes or greater.
WN22-AC-000020 - Windows Server 2022 must have the number of allowed bad logon attempts configured to three or less.