| DISA_STIG_Microsoft_Windows_Server_2016_v2r9.audit from DISA Microsoft Windows Server 2016 v2r9 STIG | |
| WN16-00-000010 - Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks. | CONFIGURATION MANAGEMENT |
| WN16-00-000030 - Passwords for the built-in Administrator account must be changed at least every 60 days. | IDENTIFICATION AND AUTHENTICATION |
| WN16-00-000040 - Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. | CONFIGURATION MANAGEMENT |
| WN16-00-000050 - Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. | CONFIGURATION MANAGEMENT |
| WN16-00-000060 - Manually managed application account passwords must be at least 14 characters in length. | IDENTIFICATION AND AUTHENTICATION |
| WN16-00-000070 - Manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. | CONFIGURATION MANAGEMENT |
| WN16-00-000080 - Shared user accounts must not be permitted on the system. | IDENTIFICATION AND AUTHENTICATION |
| WN16-00-000090 - Windows Server 2016 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. | CONFIGURATION MANAGEMENT |
| WN16-00-000100 - Windows Server 2016 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. | CONFIGURATION MANAGEMENT |
| WN16-00-000110 - Systems must be maintained at a supported servicing level. | CONFIGURATION MANAGEMENT |
| WN16-00-000120 - The Windows Server 2016 system must use an anti-virus program. | CONFIGURATION MANAGEMENT |
| WN16-00-000140 - Servers must have a host-based intrusion detection or prevention system. | CONFIGURATION MANAGEMENT |
| WN16-00-000150 - Local volumes must use a format that supports NTFS attributes. | ACCESS CONTROL |
| WN16-00-000160 - Permissions for the system drive root directory (usually C:\) must conform to minimum requirements. | ACCESS CONTROL |
| WN16-00-000170 - Permissions for program file directories must conform to minimum requirements. | ACCESS CONTROL |
| WN16-00-000180 - Permissions for the Windows installation directory must conform to minimum requirements. | ACCESS CONTROL |
| WN16-00-000190 - Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained. | ACCESS CONTROL |
| WN16-00-000200 - Non-administrative accounts or groups must only have print permissions on printer shares. | ACCESS CONTROL |
| WN16-00-000210 - Outdated or unused accounts must be removed from the system or disabled. | IDENTIFICATION AND AUTHENTICATION |
| WN16-00-000220 - Windows Server 2016 accounts must require passwords. | IDENTIFICATION AND AUTHENTICATION |
| WN16-00-000230 - Passwords must be configured to expire. | IDENTIFICATION AND AUTHENTICATION |
| WN16-00-000240 - System files must be monitored for unauthorized changes. | CONFIGURATION MANAGEMENT |
| WN16-00-000250 - Non-system-created file shares on a system must limit access to groups that require it. | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN16-00-000270 - Software certificate installation files must be removed from Windows Server 2016. | CONFIGURATION MANAGEMENT |
| WN16-00-000280 - Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN16-00-000290 - Protection methods such as TLS, encrypted VPNs, or IPsec must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. | SYSTEM AND COMMUNICATIONS PROTECTION |
| WN16-00-000300 - The roles and features required by the system must be documented. | CONFIGURATION MANAGEMENT |
| WN16-00-000310 - A host-based firewall must be installed and enabled on the system. | SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT |
| WN16-00-000320 - Windows Server 2016 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where Endpoint Security Solution (ESS) is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP) - CNDSP. | SYSTEM AND INFORMATION INTEGRITY |
| WN16-00-000330 - Windows Server 2016 must automatically remove or disable temporary user accounts after 72 hours. | ACCESS CONTROL |
| WN16-00-000340 - Windows Server 2016 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours. | ACCESS CONTROL |
| WN16-00-000350 - The Fax Server role must not be installed. | CONFIGURATION MANAGEMENT |
| WN16-00-000360 - The Microsoft FTP service must not be installed unless required. | CONFIGURATION MANAGEMENT |
| WN16-00-000370 - The Peer Name Resolution Protocol must not be installed. | CONFIGURATION MANAGEMENT |
| WN16-00-000380 - Simple TCP/IP Services must not be installed. | CONFIGURATION MANAGEMENT |
| WN16-00-000390 - The Telnet Client must not be installed. | CONFIGURATION MANAGEMENT |
| WN16-00-000400 - The TFTP Client must not be installed. | CONFIGURATION MANAGEMENT |
| WN16-00-000410 - The Server Message Block (SMB) v1 protocol must be uninstalled. | CONFIGURATION MANAGEMENT |
| WN16-00-000411 - The Server Message Block (SMB) v1 protocol must be disabled on the SMB server. | CONFIGURATION MANAGEMENT |
| WN16-00-000412 - The Server Message Block (SMB) v1 protocol must be disabled on the SMB client. | CONFIGURATION MANAGEMENT |
| WN16-00-000420 - Windows PowerShell 2.0 must not be installed. | CONFIGURATION MANAGEMENT |
| WN16-00-000430 - FTP servers must be configured to prevent anonymous logons. | CONFIGURATION MANAGEMENT |
| WN16-00-000440 - FTP servers must be configured to prevent access to the system drive. | CONFIGURATION MANAGEMENT |
| WN16-00-000450 - The time service must synchronize with an appropriate DoD time source. | AUDIT AND ACCOUNTABILITY |
| WN16-00-000460 - Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016. | CONFIGURATION MANAGEMENT |
| WN16-00-000470 - Secure Boot must be enabled on Windows Server 2016 systems. | CONFIGURATION MANAGEMENT |
| WN16-00-000480 - Windows 2016 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. | CONFIGURATION MANAGEMENT |
| WN16-AC-000010 - Windows 2016 account lockout duration must be configured to 15 minutes or greater. | ACCESS CONTROL |
| WN16-AC-000020 - Windows Server 2016 must have the number of allowed bad logon attempts configured to three or less. | ACCESS CONTROL |
