DISA_STIG_Microsoft_Windows_Server_2025_v1r3.audit from DISA Microsoft Windows Server 2025 STIG v1r3

WN25-00-000001 - Windows Server 2025 must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).

CAT|II

CCI|CCI-002605

Rule-ID|SV-277982r1181944_rule

STIG-ID|WN25-00-000001

Vuln-ID|V-277982

WN25-00-000002 - Windows Server 2025 must prohibit the use or connection of unauthorized hardware components.

CCI|CCI-003959

Rule-ID|SV-277983r1180655_rule

STIG-ID|WN25-00-000002

Vuln-ID|V-277983

WN25-00-000010 - Windows Server 2025 users with administrative privileges must have separate accounts for administrative duties and normal operational tasks.

CCI|CCI-000366

Rule-ID|SV-277985r1182240_rule

STIG-ID|WN25-00-000010

Vuln-ID|V-277985

WN25-00-000020 - Windows Server 2025 passwords for the built-in Administrator account must be changed at least every 60 days.

CCI|CCI-004066

Rule-ID|SV-277986r1182007_rule

STIG-ID|WN25-00-000020

Vuln-ID|V-277986

WN25-00-000030 - Windows Server 2025 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.

CAT|I

CCI|CCI-001312

Rule-ID|SV-277987r1212169_rule

STIG-ID|WN25-00-000030

Vuln-ID|V-277987

WN25-00-000040 - Windows Server 2025 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.

Rule-ID|SV-277988r1182011_rule

STIG-ID|WN25-00-000040

Vuln-ID|V-277988

WN25-00-000050 - Windows Server 2025 manually managed application account passwords must be at least 15 characters in length.

Rule-ID|SV-277989r1181947_rule

STIG-ID|WN25-00-000050

Vuln-ID|V-277989

WN25-00-000060 - Windows Server 2025 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Rule-ID|SV-277990r1182248_rule

STIG-ID|WN25-00-000060

Vuln-ID|V-277990

WN25-00-000070 - Windows Server 2025 shared user accounts must not be permitted.

CCI|CCI-000764

Rule-ID|SV-277991r1181778_rule

STIG-ID|WN25-00-000070

Vuln-ID|V-277991

WN25-00-000080 - Windows Server 2025 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

CCI|CCI-001774

Rule-ID|SV-277992r1182016_rule

STIG-ID|WN25-00-000080

Vuln-ID|V-277992

WN25-00-000090 - Windows Server 2025 systems must have a Trusted Platform Module (TPM) enabled and ready for use.

CCI|CCI-004910

Rule-ID|SV-277993r1212171_rule

STIG-ID|WN25-00-000090

Vuln-ID|V-277993

WN25-00-000110 - Windows Server 2025 must use an antivirus program.

Rule-ID|SV-277995r1180691_rule

STIG-ID|WN25-00-000110

Vuln-ID|V-277995

WN25-00-000120 - Windows Server 2025 must have a host-based intrusion detection and prevention service (IDPS) installed.

Rule-ID|SV-277996r1182235_rule

STIG-ID|WN25-00-000120

Vuln-ID|V-277996

WN25-00-000130 - Windows Server 2025 local volumes must use a format that supports New Technology File System (NTFS) attributes.

CCI|CCI-000213

Rule-ID|SV-277997r1182022_rule

STIG-ID|WN25-00-000130

Vuln-ID|V-277997

WN25-00-000140 - Windows Server 2025 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.

CCI|CCI-002165

Rule-ID|SV-277998r1180700_rule

STIG-ID|WN25-00-000140

Vuln-ID|V-277998

WN25-00-000150 - Windows Server 2025 permissions for program file directories must conform to minimum requirements.

Rule-ID|SV-277999r1180703_rule

STIG-ID|WN25-00-000150

Vuln-ID|V-277999

WN25-00-000160 - Windows Server 2025 permissions for the Windows installation directory must conform to minimum requirements.

Rule-ID|SV-278000r1182252_rule

STIG-ID|WN25-00-000160

Vuln-ID|V-278000

WN25-00-000170 - Windows Server 2025 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.

CCI|CCI-002235

Rule-ID|SV-278001r1211143_rule

STIG-ID|WN25-00-000170

Vuln-ID|V-278001

WN25-00-000180 - Windows Server 2025 nonadministrative accounts or groups must only have print permissions on printer shares.

CAT|III

Rule-ID|SV-278002r1181785_rule

STIG-ID|WN25-00-000180

Vuln-ID|V-278002

WN25-00-000190 - Outdated or unused accounts on Windows Server 2025 must be removed or disabled.

CCI|CCI-003627

CCI|CCI-003628

Rule-ID|SV-278003r1182254_rule

STIG-ID|WN25-00-000190

Vuln-ID|V-278003

WN25-00-000200 - Windows Server 2025 accounts must require passwords.

Rule-ID|SV-278004r1182256_rule

STIG-ID|WN25-00-000200

Vuln-ID|V-278004

WN25-00-000210 - Windows Server 2025 passwords must be configured to expire.

Rule-ID|SV-278005r1182259_rule

STIG-ID|WN25-00-000210

Vuln-ID|V-278005

WN25-00-000220 - Windows Server 2025 system files must be monitored for unauthorized changes.

CCI|CCI-001744

Rule-ID|SV-278006r1182237_rule

STIG-ID|WN25-00-000220

Vuln-ID|V-278006

WN25-00-000230 - Windows Server 2025 nonsystem-created file shares must limit access to groups that require it.

CCI|CCI-001090

Rule-ID|SV-278007r1181789_rule

STIG-ID|WN25-00-000230

Vuln-ID|V-278007

WN25-00-000240 - Windows Server 2025 must have software certificate installation files removed.

Rule-ID|SV-278008r1211146_rule

STIG-ID|WN25-00-000240

Vuln-ID|V-278008

WN25-00-000250 - Windows Server 2025 systems requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-278009r1211149_rule

STIG-ID|WN25-00-000250

Vuln-ID|V-278009

WN25-00-000260 - Windows Server 2025 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-278010r1180736_rule

STIG-ID|WN25-00-000260

Vuln-ID|V-278010

WN25-00-000270 - Windows Server 2025 must have the roles and features required by the system documented.

CCI|CCI-000381

Rule-ID|SV-278011r1182239_rule

STIG-ID|WN25-00-000270

Vuln-ID|V-278011

WN25-00-000280 - Windows Server 2025 must have a host-based firewall installed and enabled.

CCI|CCI-002406

Rule-ID|SV-278012r1181951_rule

STIG-ID|WN25-00-000280

Vuln-ID|V-278012

WN25-00-000300 - Windows Server 2025 must automatically remove or disable temporary user accounts after 72 hours.

CCI|CCI-000016

Rule-ID|SV-278013r1256709_rule

STIG-ID|WN25-00-000300

Vuln-ID|V-278013

WN25-00-000310 - Windows Server 2025 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.

CCI|CCI-001682

Rule-ID|SV-278014r1182263_rule

STIG-ID|WN25-00-000310

Vuln-ID|V-278014

WN25-00-000320 - Windows Server 2025 must not have the Fax Server role installed.

Rule-ID|SV-278015r1180751_rule

STIG-ID|WN25-00-000320

Vuln-ID|V-278015

WN25-00-000330 - Windows Server 2025 must not have the Microsoft FTP service installed unless required by the organization.

CCI|CCI-000382

Rule-ID|SV-278016r1181795_rule

STIG-ID|WN25-00-000330

Vuln-ID|V-278016

WN25-00-000332 - Windows Server 2025 must not have Wi-Fi enabled unless required by the organization.

Rule-ID|SV-278017r1256711_rule

STIG-ID|WN25-00-000332

Vuln-ID|V-278017

WN25-00-000333 - Windows Server 2025 must not have Bluetooth enabled unless required by the organization.

Rule-ID|SV-278018r1180760_rule

STIG-ID|WN25-00-000333

Vuln-ID|V-278018

WN25-00-000340 - Windows Server 2025 must not have the Peer Name Resolution Protocol installed.

Rule-ID|SV-278019r1180763_rule

STIG-ID|WN25-00-000340

Vuln-ID|V-278019

WN25-00-000350 - Windows Server 2025 must not have Simple TCP/IP Services installed.

Rule-ID|SV-278020r1180766_rule

STIG-ID|WN25-00-000350

Vuln-ID|V-278020

WN25-00-000360 - Windows Server 2025 must not have the Telnet Client installed.

Rule-ID|SV-278021r1180769_rule

STIG-ID|WN25-00-000360

Vuln-ID|V-278021

WN25-00-000370 - Windows Server 2025 must not have the TFTP Client installed.

Rule-ID|SV-278022r1180772_rule

STIG-ID|WN25-00-000370

Vuln-ID|V-278022

WN25-00-000380 - Windows Server 2025 must not have the Server Message Block (SMB) v1 protocol installed.

Rule-ID|SV-278023r1182034_rule

STIG-ID|WN25-00-000380

Vuln-ID|V-278023

WN25-00-000390 - Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.

Rule-ID|SV-278024r1182036_rule

STIG-ID|WN25-00-000390

Vuln-ID|V-278024

WN25-00-000400 - Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.

Rule-ID|SV-278025r1182038_rule

STIG-ID|WN25-00-000400

Vuln-ID|V-278025

WN25-00-000410 - Windows Server 2025 must not have Windows PowerShell 2.0 installed.

Detections

Analytics

DISA Microsoft Windows Server 2025 STIG v1r3

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Functional Update