Security Technical Implementation Guides (STIGs)


Product
Severity
SRG
CCIs
STIG IDs
Rule IDs
Tags
AppLocker
EventSentry
Security
stig
Vulnerability ID Severity Description
V-253263 High Windows 11 systems must be maintained at a supported servicing level
V-253391 Medium Windows 11 administrator accounts must not be enumerated during elevation
V-253301 Medium The maximum password age must be configured to 60 days or less
V-253435 Medium The built-in administrator account must be renamed
V-253303 Medium Passwords must, at a minimum, be 14 characters
V-253302 Medium The minimum password age must be configured to at least 1 day
V-253385 Low The Application Compatibility Program Inventory must be prevented from collecting data and sendin...
V-253436 Medium The built-in guest account must be renamed
V-253494 Medium The "Deny log on locally" user right on workstations must be configured to prevent access from hi...
V-253496 Medium The "Enable computer and user accounts to be trusted for delegation" user right must not be assig...
V-253434 Medium Local accounts with blank passwords must be restricted to prevent access from the network
V-253357 Medium Local administrator accounts must have their privileged token filtered to prevent elevated privil...
V-253432 Medium The built-in administrator account must be disabled.
V-253433 Medium The built-in guest account must be disabled
V-253265 High Local volumes must be formatted using NTFS
V-253409 Medium Indexing of encrypted files must be turned off
V-253483 Medium The "Back up files and directories" user right must only be assigned to the Administrators group
V-253324 Medium The system must be configured to audit Object Access - Removable Storage successes
V-253297 Medium Windows 11 account lockout duration must be configured to 15 minutes or greater
V-253368 Medium Windows 11 must be configured to enable Remote host allows delegation of non-exportable credentials
V-253413 Medium Automatically signing in the last interactive user after a system-initiated restart must be disabled
V-253304 Medium The built-in Microsoft password complexity filter must be enabled
V-253299 Medium The period of time before the bad logon counter is reset must be configured to 15 minutes
V-253305 High Reversible password encryption must be disabled
V-253441 Low The computer account password must not be prevented from being reset
V-253298 Medium The number of allowed bad logon attempts must be configured to three or less
V-253468 Medium User Account Control approval mode for the built-in Administrator must be enabled
V-253471 Medium User Account Control must automatically deny elevation requests for standard users
V-253474 Medium User Account Control must run all administrators in Admin Approval Mode, enabling UAC
V-253472 Medium User Account Control must be configured to detect application installations and prompt for elevation
V-253475 Medium User Account Control must virtualize file and registry write failures to per-user locations
V-253469 Medium User Account Control must prompt administrators for consent on the secure desktop
V-253473 Medium User Account Control must only elevate UIAccess applications that are installed in secure locations
V-253380 Medium Users must be prompted for a password on resume from sleep (on battery)
V-253381 Medium The user must be prompted for a password on resume from sleep (plugged in)
V-253367 Medium Command line data must be included in process creation events
V-253337 Medium The Application event log size must be configured to 32768 KB or greater
V-253338 Medium The Security event log size must be configured to 1024000 KB or greater
V-253339 Medium The System event log size must be configured to 32768 KB or greater
V-253437 Medium Audit policy using subcategories must be enabled
V-253341 Medium Windows 11 permissions for the Security event log must prevent access by non-privileged accounts
V-253342 Medium Windows 11 permissions for the System event log must prevent access by non-privileged accounts
V-253386 High Autoplay must be turned off for non-volume devices
V-253388 High Autoplay must be disabled for all drives
V-253387 High The default autorun behavior must be configured to prevent autorun commands
V-253358 Medium WDigest Authentication must be disabled
V-253490 High The "Debug programs" user right must only be assigned to the Administrators group
V-253370 High Credential Guard must be running on Windows 11 domain-joined systems
V-253447 Low Caching of logon credentials must be limited
V-253373 Medium Group Policy objects must be reprocessed even if they have not changed
V-253362 Medium Hardened UNC Paths must be defined to require mutual authentication and integrity for at least th...
V-253379 Medium Local users on domain-joined computers must not be enumerated
V-253442 Low The maximum age for machine account passwords must be configured to 30 days or less
V-253463 Medium The system must be configured to the required LDAP client signing level
V-253284 High Structured Exception Handling Overwrite Protection (SEHOP) must be enabled
V-253398 Medium File Explorer shell protocol must run in protected mode
V-253264 High The Windows 11 system must use an antivirus program
V-253374 Medium Downloading print driver packages over HTTP must be prevented
V-253372 Medium Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers
V-253275 High Internet Information System (IIS) or its subcomponents must not be installed on a workstation
V-253444 Medium The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver
V-253376 Medium Printing over HTTP must be prevented
V-253382 High Solicited Remote Assistance must not be allowed
V-253395 Medium The Microsoft Defender SmartScreen for Explorer must be enabled
V-253281 Medium A host-based firewall must be installed and enabled on the system
V-253408 Medium Basic authentication for RSS feeds over HTTP must not be used
V-253378 Medium The network selection user interface (UI) must not be displayed on the logon screen
V-253407 Medium Attachments must be prevented from being downloaded from RSS feeds
V-253445 Medium The required legal notice must be configured to display before console logon
V-253453 High Anonymous enumeration of SAM accounts must not be allowed
V-253454 High Anonymous enumeration of shares must be restricted
V-253360 Medium Insecure logons to an SMB server must be disabled
V-253460 Medium Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites
V-253462 High The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM
V-220938 High The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM
V-253455 Medium The system must be configured to prevent anonymous users from having the same rights as the Every...
V-253288 Medium The Server Message Block (SMB) v1 protocol must be disabled on the SMB client
V-253287 Medium The Server Message Block (SMB) v1 protocol must be disabled on the SMB server
V-253458 Medium NTLM must be prevented from falling back to a Null session
V-253456 High Anonymous access to Named Pipes and Shares must be restricted
V-253457 Medium Remote calls to the Security Account Manager (SAM) must be restricted to Administrators
V-253450 Medium Unencrypted passwords must not be sent to third-party SMB Servers
V-253353 Medium IPv6 source routing must be configured to highest protection
V-253277 Medium Simple TCP/IP Services must not be installed on the system
V-253300 Medium The password history must be configured to 24 passwords remembered
V-253273 Medium Accounts must be configured to require password expiration
V-253461 High The system must be configured to prevent the storage of the LAN Manager hash of passwords
V-253414 Medium PowerShell script block logging must be enabled on Windows 11
V-253285 Medium The Windows PowerShell 2.0 feature must be disabled on the system
V-253393 Medium Windows Telemetry must not be configured to Full
V-253404 Medium Remote Desktop Services must always prompt a client for passwords upon connection