| APPNET0046 - The Trust Providers Software Publishing State must be set to 0x23C00. | DISA Microsoft DotNet Framework 4.0 STIG v2r9 | Windows | IDENTIFICATION AND AUTHENTICATION |
| APPNET0055 - CAS and policy configuration files must be backed up. | DISA Microsoft DotNet Framework 4.0 STIG v2r9 | Windows | AUDIT AND ACCOUNTABILITY |
| APPNET0062 - The .NET CLR must be configured to use FIPS approved encryption modules. | DISA Microsoft DotNet Framework 4.0 STIG v2r9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| APPNET0067 - Event tracing for Windows (ETW) for Common Language Runtime events must be enabled. | DISA Microsoft DotNet Framework 4.0 STIG v2r9 | Windows | AUDIT AND ACCOUNTABILITY |
| DTBI023 - The Download unsigned ActiveX controls property must be disallowed (Internet zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI039 - Navigating windows and frames across different domains must be disallowed (Internet zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | ACCESS CONTROL |
| DTBI044 - Clipboard operations via script must be disallowed (Internet zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | CONFIGURATION MANAGEMENT |
| DTBI091 - The Java Permissions must be set with High Safety (Trusted Sites zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | CONFIGURATION MANAGEMENT |
| DTBI114 - The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Site zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI116 - ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI119 - File downloads must be disallowed (Restricted Site zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | CONFIGURATION MANAGEMENT |
| DTBI120 - Font downloads must be disallowed (Restricted Site zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI126 - Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | CONFIGURATION MANAGEMENT |
| DTBI133 - Active scripting must be disallowed (Restricted Sites Zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| DTBI136 - Logon options must be configured and enforced (Restricted Sites zone). | DISA STIG Microsoft Internet Explorer 9 v1r15 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| IIST-SI-000209 - The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | AUDIT AND ACCOUNTABILITY |
| IIST-SI-000227 - The IIS 10.0 websites Maximum Query String limit must be configured. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| IIST-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| IIST-SI-000233 - Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 website, patches, loaded modules, and directory paths. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| IIST-SI-000236 - The IIS 10.0 websites connectionTimeout setting must be explicitly configured to disconnect an idle session. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | ACCESS CONTROL |
| IIST-SI-000237 - The IIS 10.0 website must provide the capability to immediately disconnect or disable remote access to the hosted applications. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | ACCESS CONTROL |
| IIST-SI-000241 - The IIS 10.0 website must only accept client certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs). | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| IIST-SI-000264 - The required DoD banner page must be displayed to authenticated users accessing a DoD private website. | DISA Microsoft IIS 10.0 Site STIG v2r16 | Windows | CONFIGURATION MANAGEMENT |
| IIST-SV-000116 - The log data and records from the IIS 10.0 web server must be backed up onto a different system or media. | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | AUDIT AND ACCOUNTABILITY |
| IIST-SV-000117 - The IIS 10.0 web server must not perform user management for hosted applications. | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| IIST-SV-000121 - The accounts created by uninstalled features (i.e., tools, utilities, specific, etc.) must be deleted from the IIS 10.0 server. | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| IIST-SV-000143 - The IIS 10.0 web server must provide the capability to immediately disconnect or disable remote access to the hosted applications. | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | ACCESS CONTROL |
| IIST-SV-000144 - IIS 10.0 web server system files must conform to minimum file permission requirements. | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | ACCESS CONTROL |
| IIST-SV-000205 - The IIS 10.0 web server must enable HTTP Strict Transport Security (HSTS). | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | CONFIGURATION MANAGEMENT |
| IIST-SV-000215 - ASP.NET version must be removed from the HTTP Response Header information. | DISA Microsoft IIS 10.0 Server STIG v3r7 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| WN25-DC-000090 - Windows Server 2025 Active Directory (AD) Group Policy Objects (GPOs) must have proper access control permissions. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL |
| WN25-DC-000220 - Windows Server 2025 Active Directory (AD) RID Manager$ object must be configured with proper audit settings. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-DC-000250 - Windows Server 2025 must be configured to audit DS Access - Directory Service Access failures. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| WN25-DC-000300 - Windows Server 2025 PKI certificates associated with user accounts must be issued by a DOD PKI or an approved External Certificate Authority (ECA). | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-DC-000310 - Windows Server 2025 Active Directory (AD) user accounts, including administrators, must be configured to require the use of a common access card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-DC-000390 - The Windows Server 2025 'Deny log on as a service' user right must be configured to include no accounts or groups (blank) on domain controllers. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL |
| WN25-DC-000406 - Windows Server 2025 must be configured for name-based strong mappings for certificates. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL |
| WN25-MS-000030 - Windows Server 2025 local users on domain-joined member servers must not be enumerated. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | CONFIGURATION MANAGEMENT |
| WN25-MS-000040 - Windows Server 2025 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and stand-alone or nondomain-joined systems. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-PK-000020 - Windows Server 2025 must have the DOD Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-SO-000020 - Windows Server 2025 must prevent local accounts with blank passwords from being used from the network. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000040 - The Windows Server 2025 built-in guest account must be renamed. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000110 - Windows Server 2025 must be configured to require a strong session key. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN25-SO-000180 - Windows Server 2025 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-SO-000240 - Windows Server 2025 must be configured to prevent anonymous users from having the same permissions as the Everyone group. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | CONFIGURATION MANAGEMENT |
| WN25-SO-000290 - Windows Server 2025 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-SO-000350 - Windows Server 2025 users must be required to enter a password to access private keys stored on the computer. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WN25-UR-000100 - The Windows Server 2025 'Debug programs' user right must only be assigned to the Administrators group. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL |
| WN25-UR-000140 - The Windows Server 2025 'Increase scheduling priority' user right must only be assigned to the Administrators group. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL |
| WN25-UR-000150 - The Windows Server 2025 'Load and unload device drivers' user right must only be assigned to the Administrators group. | DISA Microsoft Windows Server 2025 STIG v1r1 | Windows | ACCESS CONTROL |
