DISA_STIG_Windows_10_v3r2.audit from DISA Microsoft Windows 10 v3r2 STIG

WN10-00-000005 - Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.

CAT|II

CCI|CCI-000366

Rule-ID|SV-220697r991589_rule

STIG-ID|WN10-00-000005

STIG-Legacy|SV-77809

STIG-Legacy|V-63319

Vuln-ID|V-220697

WN10-00-000010 - Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.

Rule-ID|SV-220698r991589_rule

STIG-ID|WN10-00-000010

STIG-Legacy|SV-77813

STIG-Legacy|V-63323

Vuln-ID|V-220698

WN10-00-000015 - Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.

Rule-ID|SV-220699r991589_rule

STIG-ID|WN10-00-000015

STIG-Legacy|SV-91779

STIG-Legacy|V-77083

Vuln-ID|V-220699

WN10-00-000020 - Secure Boot must be enabled on Windows 10 systems.

CAT|III

Rule-ID|SV-220700r991589_rule

STIG-ID|WN10-00-000020

STIG-Legacy|SV-91781

STIG-Legacy|V-77085

Vuln-ID|V-220700

WN10-00-000025 - Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: Continuously, where ESS is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).

Rule-ID|SV-220701r1000076_rule

STIG-ID|WN10-00-000025

STIG-Legacy|SV-77833

STIG-Legacy|V-63343

Vuln-ID|V-220701

WN10-00-000030 - Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.

CAT|I

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-220702r958552_rule

STIG-ID|WN10-00-000030

STIG-Legacy|SV-77827

STIG-Legacy|V-63337

Vuln-ID|V-220702

WN10-00-000031 - Windows 10 systems must use a BitLocker PIN for pre-boot authentication.

Rule-ID|SV-220703r958552_rule

STIG-ID|WN10-00-000031

STIG-Legacy|SV-104689

STIG-Legacy|V-94859

Vuln-ID|V-220703

WN10-00-000032 - Windows 10 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.

Rule-ID|SV-220704r958552_rule

STIG-ID|WN10-00-000032

STIG-Legacy|SV-104691

STIG-Legacy|V-94861

Vuln-ID|V-220704

WN10-00-000035 - The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

CCI|CCI-001774

Rule-ID|SV-220705r958808_rule

STIG-ID|WN10-00-000035

STIG-Legacy|SV-77835

STIG-Legacy|V-63345

Vuln-ID|V-220705

WN10-00-000040 - Windows 10 systems must be maintained at a supported servicing level.

Rule-ID|SV-220706r991589_rule

STIG-ID|WN10-00-000040

STIG-Legacy|SV-77839

STIG-Legacy|V-63349

Vuln-ID|V-220706

WN10-00-000045 - The Windows 10 system must use an anti-virus program.

Rule-ID|SV-220707r1016358_rule

STIG-ID|WN10-00-000045

STIG-Legacy|SV-77841

STIG-Legacy|V-63351

Vuln-ID|V-220707

WN10-00-000050 - Local volumes must be formatted using NTFS.

CCI|CCI-000213

Rule-ID|SV-220708r958472_rule

STIG-ID|WN10-00-000050

STIG-Legacy|SV-77843

STIG-Legacy|V-63353

Vuln-ID|V-220708

WN10-00-000055 - Alternate operating systems must not be permitted on the same system.

Rule-ID|SV-220709r991589_rule

STIG-ID|WN10-00-000055

STIG-Legacy|SV-77845

STIG-Legacy|V-63355

Vuln-ID|V-220709

WN10-00-000060 - Non system-created file shares on a system must limit access to groups that require it.

CCI|CCI-001090

Rule-ID|SV-220710r958524_rule

STIG-ID|WN10-00-000060

STIG-Legacy|SV-77847

STIG-Legacy|V-63357

Vuln-ID|V-220710

WN10-00-000065 - Unused accounts must be disabled or removed from the system after 35 days of inactivity.

CCI|CCI-000795

CCI|CCI-003627

Rule-ID|SV-220711r1016403_rule

STIG-ID|WN10-00-000065

STIG-Legacy|SV-77849

STIG-Legacy|V-63359

Vuln-ID|V-220711

WN10-00-000070 - Only accounts responsible for the administration of a system must have Administrator rights on the system.

CCI|CCI-002235

Rule-ID|SV-220712r958726_rule

STIG-ID|WN10-00-000070

STIG-Legacy|SV-77851

STIG-Legacy|V-63361

Vuln-ID|V-220712

WN10-00-000075 - Only accounts responsible for the backup operations must be members of the Backup Operators group.

Rule-ID|SV-220713r991589_rule

STIG-ID|WN10-00-000075

STIG-Legacy|SV-77853

STIG-Legacy|V-63363

Vuln-ID|V-220713

WN10-00-000080 - Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.

CCI|CCI-000381

Rule-ID|SV-220714r958478_rule

STIG-ID|WN10-00-000080

STIG-Legacy|SV-77855

STIG-Legacy|V-63365

Vuln-ID|V-220714

WN10-00-000085 - Standard local user accounts must not exist on a system in a domain.

Rule-ID|SV-220715r991589_rule

STIG-ID|WN10-00-000085

STIG-Legacy|SV-77857

STIG-Legacy|V-63367

Vuln-ID|V-220715

WN10-00-000090 - Accounts must be configured to require password expiration.

CCI|CCI-000199

CCI|CCI-004066

Rule-ID|SV-220716r1016404_rule

STIG-ID|WN10-00-000090

STIG-Legacy|SV-77861

STIG-Legacy|V-63371

Vuln-ID|V-220716

WN10-00-000095 - Permissions for system files and directories must conform to minimum requirements.

CCI|CCI-002165

Rule-ID|SV-220717r958702_rule

STIG-ID|WN10-00-000095

STIG-Legacy|SV-77863

STIG-Legacy|V-63373

Vuln-ID|V-220717

WN10-00-000100 - Internet Information System (IIS) or its subcomponents must not be installed on a workstation.

Rule-ID|SV-220718r958478_rule

STIG-ID|WN10-00-000100

STIG-Legacy|SV-77867

STIG-Legacy|V-63377

Vuln-ID|V-220718

WN10-00-000105 - Simple Network Management Protocol (SNMP) must not be installed on the system.

CCI|CCI-000382

Rule-ID|SV-220719r958480_rule

STIG-ID|WN10-00-000105

STIG-Legacy|SV-77871

STIG-Legacy|V-63381

Vuln-ID|V-220719

WN10-00-000107 - Copilot in Windows must be disabled for Windows 10.

Rule-ID|SV-268315r1016354_rule

STIG-ID|WN10-00-000107

Vuln-ID|V-268315

WN10-00-000110 - Simple TCP/IP Services must not be installed on the system.

Rule-ID|SV-220720r958478_rule

STIG-ID|WN10-00-000110

STIG-Legacy|SV-77873

STIG-Legacy|V-63383

Vuln-ID|V-220720

WN10-00-000115 - The Telnet Client must not be installed on the system.

Rule-ID|SV-220721r958480_rule

STIG-ID|WN10-00-000115

STIG-Legacy|SV-77875

STIG-Legacy|V-63385

Vuln-ID|V-220721

WN10-00-000120 - The TFTP Client must not be installed on the system.

Rule-ID|SV-220722r958480_rule

STIG-ID|WN10-00-000120

STIG-Legacy|SV-77879

STIG-Legacy|V-63389

Vuln-ID|V-220722

WN10-00-000130 - Software certificate installation files must be removed from Windows 10.

Rule-ID|SV-220723r991589_rule

STIG-ID|WN10-00-000130

STIG-Legacy|SV-77883

STIG-Legacy|V-63393

Vuln-ID|V-220723

WN10-00-000135 - A host-based firewall must be installed and enabled on the system.

Rule-ID|SV-220724r991589_rule

STIG-ID|WN10-00-000135

STIG-Legacy|SV-77889

STIG-Legacy|V-63399

Vuln-ID|V-220724

WN10-00-000140 - Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.

Rule-ID|SV-220725r991589_rule

STIG-ID|WN10-00-000140

STIG-Legacy|SV-77893

STIG-Legacy|V-63403

Vuln-ID|V-220725

WN10-00-000145 - Data Execution Prevention (DEP) must be configured to at least OptOut.

CCI|CCI-002824

Rule-ID|SV-220726r958928_rule

STIG-ID|WN10-00-000145

Detections

Analytics

DISA Windows 10 STIG v3r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Informational Update