DISA_STIG_Microsoft_Windows_Server_2016_v2r8.audit from DISA Microsoft Windows Server 2016 v2r8 STIG

WN16-00-000010 - Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.

CAT|I

CCI|CCI-000366

Rule-ID|SV-224819r569186_rule

STIG-ID|WN16-00-000010

STIG-Legacy|SV-87869

STIG-Legacy|V-73217

Vuln-ID|V-224819

WN16-00-000030 - Passwords for the built-in Administrator account must be changed at least every 60 days.

CAT|II

CCI|CCI-000199

Rule-ID|SV-224820r857224_rule

STIG-ID|WN16-00-000030

STIG-Legacy|SV-87875

STIG-Legacy|V-73223

Vuln-ID|V-224820

WN16-00-000040 - Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.

Rule-ID|SV-224821r569186_rule

STIG-ID|WN16-00-000040

STIG-Legacy|SV-87877

STIG-Legacy|V-73225

Vuln-ID|V-224821

WN16-00-000050 - Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.

Rule-ID|SV-224822r569186_rule

STIG-ID|WN16-00-000050

STIG-Legacy|SV-87879

STIG-Legacy|V-73227

Vuln-ID|V-224822

WN16-00-000060 - Manually managed application account passwords must be at least 14 characters in length.

CCI|CCI-000205

Rule-ID|SV-224823r953812_rule

STIG-ID|WN16-00-000060

STIG-Legacy|SV-87881

STIG-Legacy|V-73229

Vuln-ID|V-224823

WN16-00-000070 - Manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Rule-ID|SV-224824r857226_rule

STIG-ID|WN16-00-000070

STIG-Legacy|SV-87883

STIG-Legacy|V-73231

Vuln-ID|V-224824

WN16-00-000080 - Shared user accounts must not be permitted on the system.

CCI|CCI-000764

Rule-ID|SV-224825r569186_rule

STIG-ID|WN16-00-000080

STIG-Legacy|SV-87885

STIG-Legacy|V-73233

Vuln-ID|V-224825

WN16-00-000090 - Windows Server 2016 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

CCI|CCI-001774

Rule-ID|SV-224826r890501_rule

STIG-ID|WN16-00-000090

STIG-Legacy|SV-87887

STIG-Legacy|V-73235

Vuln-ID|V-224826

WN16-00-000100 - Windows Server 2016 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.

Rule-ID|SV-224827r902425_rule

STIG-ID|WN16-00-000100

STIG-Legacy|SV-87889

STIG-Legacy|V-73237

Vuln-ID|V-224827

WN16-00-000110 - Systems must be maintained at a supported servicing level.

Rule-ID|SV-224828r569186_rule

STIG-ID|WN16-00-000110

STIG-Legacy|SV-87891

STIG-Legacy|V-73239

Vuln-ID|V-224828

WN16-00-000120 - The Windows Server 2016 system must use an anti-virus program.

Rule-ID|SV-224829r569237_rule

STIG-ID|WN16-00-000120

STIG-Legacy|SV-87893

STIG-Legacy|V-73241

Vuln-ID|V-224829

WN16-00-000140 - Servers must have a host-based intrusion detection or prevention system.

Rule-ID|SV-224830r793223_rule

STIG-ID|WN16-00-000140

STIG-Legacy|SV-87897

STIG-Legacy|V-73245

Vuln-ID|V-224830

WN16-00-000150 - Local volumes must use a format that supports NTFS attributes.

CCI|CCI-000213

Rule-ID|SV-224831r569186_rule

STIG-ID|WN16-00-000150

STIG-Legacy|SV-87899

STIG-Legacy|V-73247

Vuln-ID|V-224831

WN16-00-000160 - Permissions for the system drive root directory (usually C:\) must conform to minimum requirements.

CCI|CCI-002165

Rule-ID|SV-224832r852289_rule

STIG-ID|WN16-00-000160

STIG-Legacy|SV-87901

STIG-Legacy|V-73249

Vuln-ID|V-224832

WN16-00-000170 - Permissions for program file directories must conform to minimum requirements.

Rule-ID|SV-224833r852290_rule

STIG-ID|WN16-00-000170

STIG-Legacy|SV-87903

STIG-Legacy|V-73251

Vuln-ID|V-224833

WN16-00-000180 - Permissions for the Windows installation directory must conform to minimum requirements.

Rule-ID|SV-224834r852291_rule

STIG-ID|WN16-00-000180

STIG-Legacy|SV-87905

STIG-Legacy|V-73253

Vuln-ID|V-224834

WN16-00-000190 - Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.

CCI|CCI-002235

Rule-ID|SV-224835r877392_rule

STIG-ID|WN16-00-000190

STIG-Legacy|SV-87907

STIG-Legacy|V-73255

Vuln-ID|V-224835

WN16-00-000200 - Non-administrative accounts or groups must only have print permissions on printer shares.

CAT|III

Rule-ID|SV-224836r569186_rule

STIG-ID|WN16-00-000200

STIG-Legacy|SV-87909

STIG-Legacy|V-73257

Vuln-ID|V-224836

WN16-00-000210 - Outdated or unused accounts must be removed from the system or disabled.

CCI|CCI-000795

Rule-ID|SV-224837r857230_rule

STIG-ID|WN16-00-000210

STIG-Legacy|SV-87911

STIG-Legacy|V-73259

Vuln-ID|V-224837

WN16-00-000220 - Windows Server 2016 accounts must require passwords.

Rule-ID|SV-224838r857232_rule

STIG-ID|WN16-00-000220

STIG-Legacy|SV-87913

STIG-Legacy|V-73261

Vuln-ID|V-224838

WN16-00-000230 - Passwords must be configured to expire.

Rule-ID|SV-224839r857235_rule

STIG-ID|WN16-00-000230

STIG-Legacy|SV-87915

STIG-Legacy|V-73263

Vuln-ID|V-224839

WN16-00-000240 - System files must be monitored for unauthorized changes.

CCI|CCI-001744

Rule-ID|SV-224840r891691_rule

STIG-ID|WN16-00-000240

STIG-Legacy|SV-87917

STIG-Legacy|V-73265

Vuln-ID|V-224840

WN16-00-000250 - Non-system-created file shares on a system must limit access to groups that require it.

CCI|CCI-001090

Rule-ID|SV-224841r569186_rule

STIG-ID|WN16-00-000250

STIG-Legacy|SV-87919

STIG-Legacy|V-73267

Vuln-ID|V-224841

WN16-00-000270 - Software certificate installation files must be removed from Windows Server 2016.

Rule-ID|SV-224842r569186_rule

STIG-ID|WN16-00-000270

STIG-Legacy|SV-87923

STIG-Legacy|V-73271

Vuln-ID|V-224842

WN16-00-000280 - Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-224843r953813_rule

STIG-ID|WN16-00-000280

STIG-Legacy|SV-87925

STIG-Legacy|V-73273

Vuln-ID|V-224843

WN16-00-000290 - Protection methods such as TLS, encrypted VPNs, or IPsec must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-224844r852298_rule

STIG-ID|WN16-00-000290

STIG-Legacy|SV-87927

STIG-Legacy|V-73275

Vuln-ID|V-224844

WN16-00-000300 - The roles and features required by the system must be documented.

CCI|CCI-000381

Rule-ID|SV-224845r569186_rule

STIG-ID|WN16-00-000300

STIG-Legacy|SV-87929

STIG-Legacy|V-73277

Vuln-ID|V-224845

WN16-00-000310 - A host-based firewall must be installed and enabled on the system.

CCI|CCI-002080

Rule-ID|SV-224846r852299_rule

STIG-ID|WN16-00-000310

STIG-Legacy|SV-87931

STIG-Legacy|V-73279

Vuln-ID|V-224846

WN16-00-000320 - Windows  Server 2016 must employ automated mechanisms to determine the state of  system components with regard to flaw remediation using the following  frequency: continuously, where Endpoint Security Solution (ESS) is  used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense  Service Provider (CNDSP) - CNDSP.

CCI|CCI-001233

Rule-ID|SV-224847r939261_rule

STIG-ID|WN16-00-000320

STIG-Legacy|SV-87933

STIG-Legacy|V-73281

Vuln-ID|V-224847

WN16-00-000330 - Windows Server 2016 must automatically remove or disable temporary user accounts after 72 hours.

CCI|CCI-000016

Rule-ID|SV-224848r857240_rule

STIG-ID|WN16-00-000330

Detections

Analytics

DISA Windows Server 2016 STIG v2r8

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Functional Update

Detections

Analytics

DISA Windows Server 2016 STIG v2r8 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Functional Update

DISA Windows Server 2016 STIG v2r8