DISA_STIG_Microsoft_Windows_Server_2025_v1r1.audit from DISA Microsoft Windows Server 2025 STIG v1r1

WN25-00-000001 - Windows Server 2025 must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).

800-53|SI-2c.

CAT|II

CCI|CCI-002605

Rule-ID|SV-277982r1181944_rule

STIG-ID|WN25-00-000001

Vuln-ID|V-277982

WN25-00-000002 - Windows Server 2025 must prohibit the use or connection of unauthorized hardware components.

800-53|CM-6b.

CCI|CCI-003959

Rule-ID|SV-277983r1180655_rule

STIG-ID|WN25-00-000002

Vuln-ID|V-277983

WN25-00-000010 - Windows Server 2025 users with administrative privileges must have separate accounts for administrative duties and normal operational tasks.

CCI|CCI-000366

Rule-ID|SV-277985r1182240_rule

STIG-ID|WN25-00-000010

Vuln-ID|V-277985

WN25-00-000020 - Windows Server 2025 passwords for the built-in Administrator account must be changed at least every 60 days.

800-53|IA-5(1)(a)

CCI|CCI-004066

Rule-ID|SV-277986r1182007_rule

STIG-ID|WN25-00-000020

Vuln-ID|V-277986

WN25-00-000030 - Windows Server 2025 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.

800-53|SI-11a.

CAT|I

CCI|CCI-001312

Rule-ID|SV-277987r1182010_rule

STIG-ID|WN25-00-000030

Vuln-ID|V-277987

WN25-00-000040 - Windows Server 2025 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.

Rule-ID|SV-277988r1182011_rule

STIG-ID|WN25-00-000040

Vuln-ID|V-277988

WN25-00-000050 - Windows Server 2025 manually managed application account passwords must be at least 15 characters in length.

Rule-ID|SV-277989r1181947_rule

STIG-ID|WN25-00-000050

Vuln-ID|V-277989

WN25-00-000060 - Windows Server 2025 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Rule-ID|SV-277990r1182248_rule

STIG-ID|WN25-00-000060

Vuln-ID|V-277990

WN25-00-000070 - Windows Server 2025 shared user accounts must not be permitted.

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-277991r1181778_rule

STIG-ID|WN25-00-000070

Vuln-ID|V-277991

WN25-00-000080 - Windows Server 2025 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

800-53|CM-7(5)(b)

CCI|CCI-001774

Rule-ID|SV-277992r1182016_rule

STIG-ID|WN25-00-000080

Vuln-ID|V-277992

WN25-00-000090 - Windows Server 2025 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.

CCI|CCI-004910

Rule-ID|SV-277993r1182250_rule

STIG-ID|WN25-00-000090

Vuln-ID|V-277993

WN25-00-000110 - Windows Server 2025 must use an antivirus program.

Rule-ID|SV-277995r1180691_rule

STIG-ID|WN25-00-000110

Vuln-ID|V-277995

WN25-00-000120 - Windows Server 2025 must have a host-based intrusion detection and prevention service (IDPS) installed.

Rule-ID|SV-277996r1182235_rule

STIG-ID|WN25-00-000120

Vuln-ID|V-277996

WN25-00-000130 - Windows Server 2025 local volumes must use a format that supports New Technology File System (NTFS) attributes.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-277997r1182022_rule

STIG-ID|WN25-00-000130

Vuln-ID|V-277997

WN25-00-000140 - Windows Server 2025 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.

800-53|AC-3(4)

CCI|CCI-002165

Rule-ID|SV-277998r1180700_rule

STIG-ID|WN25-00-000140

Vuln-ID|V-277998

WN25-00-000150 - Windows Server 2025 permissions for program file directories must conform to minimum requirements.

Rule-ID|SV-277999r1180703_rule

STIG-ID|WN25-00-000150

Vuln-ID|V-277999

WN25-00-000160 - Windows Server 2025 permissions for the Windows installation directory must conform to minimum requirements.

Rule-ID|SV-278000r1182252_rule

STIG-ID|WN25-00-000160

Vuln-ID|V-278000

WN25-00-000170 - Windows Server 2025 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-278001r1181950_rule

STIG-ID|WN25-00-000170

Vuln-ID|V-278001

WN25-00-000180 - Windows Server 2025 nonadministrative accounts or groups must only have print permissions on printer shares.

CAT|III

Rule-ID|SV-278002r1181785_rule

STIG-ID|WN25-00-000180

Vuln-ID|V-278002

WN25-00-000190 - Outdated or unused accounts on Windows Server 2025 must be removed or disabled.

800-53|AC-2(3)

CCI|CCI-003627

CCI|CCI-003628

Rule-ID|SV-278003r1182254_rule

STIG-ID|WN25-00-000190

Vuln-ID|V-278003

WN25-00-000200 - Windows Server 2025 accounts must require passwords.

Rule-ID|SV-278004r1182256_rule

STIG-ID|WN25-00-000200

Vuln-ID|V-278004

WN25-00-000210 - Windows Server 2025 passwords must be configured to expire.

Rule-ID|SV-278005r1182259_rule

STIG-ID|WN25-00-000210

Vuln-ID|V-278005

WN25-00-000220 - Windows Server 2025 system files must be monitored for unauthorized changes.

800-53|CM-3(5)

CCI|CCI-001744

Rule-ID|SV-278006r1182237_rule

STIG-ID|WN25-00-000220

Vuln-ID|V-278006

WN25-00-000230 - Windows Server 2025 nonsystem-created file shares must limit access to groups that require it.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-278007r1181789_rule

STIG-ID|WN25-00-000230

Vuln-ID|V-278007

WN25-00-000240 - Windows Server 2025 must have software certificate installation files removed.

Rule-ID|SV-278008r1180730_rule

STIG-ID|WN25-00-000240

Vuln-ID|V-278008

WN25-00-000250 - Windows Server 2025 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

800-53|SC-28

800-53|SC-28(1)

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-278009r1180733_rule

STIG-ID|WN25-00-000250

Vuln-ID|V-278009

WN25-00-000260 - Windows Server 2025 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.

800-53|SC-8(2)

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-278010r1180736_rule

STIG-ID|WN25-00-000260

Vuln-ID|V-278010

WN25-00-000270 - Windows Server 2025 must have the roles and features required by the system documented.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-278011r1182239_rule

STIG-ID|WN25-00-000270

Vuln-ID|V-278011

WN25-00-000280 - Windows Server 2025 must have a host-based firewall installed and enabled.

800-53|SC-7(12)

CCI|CCI-002406

Rule-ID|SV-278012r1181951_rule

STIG-ID|WN25-00-000280

Vuln-ID|V-278012

WN25-00-000300 - Windows Server 2025 must automatically remove or disable temporary user accounts after 72 hours.

800-53|AC-2(2)

CCI|CCI-000016

Rule-ID|SV-278013r1182261_rule

STIG-ID|WN25-00-000300

Vuln-ID|V-278013

WN25-00-000310 - Windows Server 2025 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.

CCI|CCI-001682

Rule-ID|SV-278014r1182263_rule

STIG-ID|WN25-00-000310

Vuln-ID|V-278014

WN25-00-000320 - Windows Server 2025 must not have the Fax Server role installed.

Rule-ID|SV-278015r1180751_rule

STIG-ID|WN25-00-000320

Vuln-ID|V-278015

WN25-00-000330 - Windows Server 2025 must not have the Microsoft FTP service installed unless required by the organization.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-278016r1181795_rule

STIG-ID|WN25-00-000330

Vuln-ID|V-278016

WN25-00-000332 - Windows Server 2025 must not have Wi-Fi enabled unless required by the organization.

Rule-ID|SV-278017r1180757_rule

STIG-ID|WN25-00-000332

Vuln-ID|V-278017

WN25-00-000333 - Windows Server 2025 must not have Bluetooth enabled unless required by the organization.

Rule-ID|SV-278018r1180760_rule

STIG-ID|WN25-00-000333

Vuln-ID|V-278018

WN25-00-000340 - Windows Server 2025 must not have the Peer Name Resolution Protocol installed.

Rule-ID|SV-278019r1180763_rule

STIG-ID|WN25-00-000340

Vuln-ID|V-278019

WN25-00-000350 - Windows Server 2025 must not have Simple TCP/IP Services installed.

Rule-ID|SV-278020r1180766_rule

STIG-ID|WN25-00-000350

Vuln-ID|V-278020

WN25-00-000360 - Windows Server 2025 must not have the Telnet Client installed.

Rule-ID|SV-278021r1180769_rule

STIG-ID|WN25-00-000360

Vuln-ID|V-278021

WN25-00-000370 - Windows Server 2025 must not have the TFTP Client installed.

Detections

Analytics

DISA Microsoft Windows Server 2025 STIG v1r1

Audit Details

Audit Changelog

Revision 1.1

Functional Update