DISA Windows Server 2012 and 2012 R2 MS STIG v3r1

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: DISA Windows Server 2012 and 2012 R2 MS STIG v3r1

Updated: 11/4/2021

Authority: DISA STIG

Plugin: Windows

Revision: 1.10

Estimated Item Count: 356

Audit Changelog


Revision 1.10 Nov 4, 2021 Functional Update WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. WN12-PK-000004 - The US DoD CCEB Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.
Revision 1.9 Oct 5, 2021 Functional Update WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.8 Sep 10, 2021 Functional Update WN12-00-000007 - Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization. WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. WN12-AU-000205 - Permissions for the Security event log must prevent access by nonprivileged accounts. WN12-CC-000142 - The Windows Explorer Preview pane must be disabled for Windows 2012 - NoPreviewPane WN12-CC-000142 - The Windows Explorer Preview pane must be disabled for Windows 2012 - NoReadingPane WN12-GE-000006 - Permissions for system drive root directory (usually C:\) must conform to minimum requirements. WN12-SO-000013 - Outgoing secure channel traffic must be encrypted when possible. WN12-SO-000014 - Outgoing secure channel traffic must be signed when possible. WN12-UC-000001 - A screen saver must be enabled on the system. WN12-UC-000003 - The screen saver must be password protected. WN12-UC-000007 - The Windows Help Experience Improvement Program must be disabled. WN12-UC-000008 - Windows Help Ratings feedback must be turned off. WN12-UC-000012 - Users must be prevented from sharing files in their profiles. WN12-UC-000013 - Media Player must be configured to prevent automatic Codec downloads. Added WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - Root CA 2 WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - Root CA 3 WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - Root CA 4 WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - Root CA 5 Removed WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - DoD Root CA 2 WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - DoD Root CA 3 WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - DoD Root CA 4 WN12-PK-000001 - The DoD Root CA certificates must be installed in the Trusted Root Store - DoD Root CA 5
Revision 1.7 Aug 11, 2021 Functional Update WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. WN12-GE-000020 - Software certificate installation files must be removed from Windows 2012/2012 R2.
Revision 1.6 Jul 30, 2021 Functional Update WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. Miscellaneous Metadata updated. References updated.
Revision 1.5 Jun 17, 2021 Functional Update WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. Miscellaneous Metadata updated. References updated.
Revision 1.4 May 14, 2021 Functional Update WN12-00-000007 - Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization. WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. WN12-AU-000206 - Permissions for the System event log must prevent access by nonprivileged accounts.
Revision 1.3 Apr 2, 2021 Functional Update WN12-00-000007 - Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization. WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater. WN12-AU-000204 - Permissions for the Application event log must prevent access by nonprivileged accounts.