DISA_STIG_Server_2012_and_2012_R2_MS_v3r2.audit from DISA Microsoft Windows Server 2012/2012 R2 Member Server v3r2 STIG

WN12-00-000001 - Server systems must be located in a controlled access area, accessible only to authorized personnel.

800-53|CM-6b.

CAT|II

CCI|CCI-000366

Rule-ID|SV-225239r569185_rule

STIG-ID|WN12-00-000001

STIG-Legacy|SV-52838

STIG-Legacy|V-1070

Vuln-ID|V-225239

WN12-00-000004 - Users with administrative privilege must be documented.

Rule-ID|SV-225240r569185_rule

STIG-ID|WN12-00-000004

STIG-Legacy|SV-51575

STIG-Legacy|V-36658

Vuln-ID|V-225240

WN12-00-000005 - Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.

CAT|I

Rule-ID|SV-225241r569185_rule

STIG-ID|WN12-00-000005

STIG-Legacy|SV-51576

STIG-Legacy|V-36659

Vuln-ID|V-225241

WN12-00-000006 - Policy must require that system administrators (SAs) be trained for the operating systems used by systems under their control.

Rule-ID|SV-225242r569185_rule

STIG-ID|WN12-00-000006

STIG-Legacy|SV-51577

STIG-Legacy|V-36666

Vuln-ID|V-225242

WN12-00-000007 - Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization.

Rule-ID|SV-225243r569185_rule

STIG-ID|WN12-00-000007

STIG-Legacy|SV-52942

STIG-Legacy|V-14225

Vuln-ID|V-225243

WN12-00-000008 - Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.

Rule-ID|SV-225244r569185_rule

STIG-ID|WN12-00-000008

STIG-Legacy|SV-51578

STIG-Legacy|V-36451

Vuln-ID|V-225244

WN12-00-000009-01 - Members of the Backup Operators group must be documented.

Rule-ID|SV-225245r569185_rule

STIG-ID|WN12-00-000009-01

STIG-Legacy|SV-52156

STIG-Legacy|V-1168

Vuln-ID|V-225245

WN12-00-000009-02 - Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.

Rule-ID|SV-225246r569185_rule

STIG-ID|WN12-00-000009-02

STIG-Legacy|SV-52157

STIG-Legacy|V-40198

Vuln-ID|V-225246

WN12-00-000010 - Policy must require application account passwords be at least 15 characters in length.

800-53|IA-5(1)(a)

CCI|CCI-000205

Rule-ID|SV-225247r569185_rule

STIG-ID|WN12-00-000010

STIG-Legacy|SV-51579

STIG-Legacy|V-36661

Vuln-ID|V-225247

WN12-00-000011 - Windows 2012/2012 R2 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.

Rule-ID|SV-225248r569185_rule

STIG-ID|WN12-00-000011

STIG-Legacy|SV-51580

STIG-Legacy|V-36662

Vuln-ID|V-225248

WN12-00-000012 - Shared user accounts must not be permitted on the system.

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-225249r569185_rule

STIG-ID|WN12-00-000012

STIG-Legacy|SV-52839

STIG-Legacy|V-1072

Vuln-ID|V-225249

WN12-00-000013 - Security configuration tools or equivalent processes must be used to configure and maintain platforms for security compliance.

CAT|III

Rule-ID|SV-225250r569185_rule

STIG-ID|WN12-00-000013

STIG-Legacy|SV-52859

STIG-Legacy|V-1128

Vuln-ID|V-225250

WN12-00-000014 - System-level information must be backed up in accordance with local recovery time and recovery point objectives.

Rule-ID|SV-225251r569185_rule

STIG-ID|WN12-00-000014

STIG-Legacy|SV-52841

STIG-Legacy|V-1076

Vuln-ID|V-225251

WN12-00-000015 - User-level information must be backed up in accordance with local recovery time and recovery point objectives.

Rule-ID|SV-225252r569185_rule

STIG-ID|WN12-00-000015

STIG-Legacy|SV-51581

STIG-Legacy|V-36733

Vuln-ID|V-225252

WN12-00-000016 - Backups of system-level information must be protected.

Rule-ID|SV-225253r569185_rule

STIG-ID|WN12-00-000016

STIG-Legacy|SV-52130

STIG-Legacy|V-40172

Vuln-ID|V-225253

WN12-00-000017 - System-related documentation must be backed up in accordance with local recovery time and recovery point objectives.

Rule-ID|SV-225254r569185_rule

STIG-ID|WN12-00-000017

STIG-Legacy|SV-52131

STIG-Legacy|V-40173

Vuln-ID|V-225254

WN12-00-000018 - The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

800-53|CM-7(5)(b)

CCI|CCI-001774

Rule-ID|SV-225255r569185_rule

STIG-ID|WN12-00-000018

STIG-Legacy|SV-72047

STIG-Legacy|V-57637

Vuln-ID|V-225255

WN12-00-000019 - Protection methods such as TLS, encrypted VPNs, or IPSEC must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.

800-53|SC-8(2)

CCI|CCI-002420

CCI|CCI-002422

Rule-ID|SV-225256r569185_rule

STIG-ID|WN12-00-000019

STIG-Legacy|SV-72051

STIG-Legacy|V-57641

Vuln-ID|V-225256

WN12-00-000020 - Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.

800-53|SC-28

800-53|SC-28(1)

CCI|CCI-001199

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-225257r569185_rule

STIG-ID|WN12-00-000020

STIG-Legacy|SV-72055

STIG-Legacy|V-57645

Vuln-ID|V-225257

WN12-00-000100 - The Windows 2012 / 2012 R2 system must use an anti-virus program.

Rule-ID|SV-225258r569185_rule

STIG-ID|WN12-00-000100

STIG-Legacy|SV-52103

STIG-Legacy|V-1074

Vuln-ID|V-225258

WN12-00-000160 - The Server Message Block (SMB) v1 protocol must be disabled on Windows 2012 R2.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-225259r569185_rule

STIG-ID|WN12-00-000160

STIG-Legacy|SV-88471

STIG-Legacy|V-73805

Vuln-ID|V-225259

WN12-00-000170 - The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.

Rule-ID|SV-225260r569185_rule

STIG-ID|WN12-00-000170

STIG-Legacy|SV-88193

STIG-Legacy|V-73519

Vuln-ID|V-225260

WN12-00-000180 - The Server Message Block (SMB) v1 protocol must be disabled on the SMB client - LanManWorkstation

Rule-ID|SV-225261r569185_rule

STIG-ID|WN12-00-000180

STIG-Legacy|SV-88205

STIG-Legacy|V-73523

Vuln-ID|V-225261

WN12-00-000180 - The Server Message Block (SMB) v1 protocol must be disabled on the SMB client - mrxsmb10

WN12-00-000190 - Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2012 / 2012 R2.

Rule-ID|SV-225262r569185_rule

STIG-ID|WN12-00-000190

STIG-Legacy|SV-90603

STIG-Legacy|V-75915

Vuln-ID|V-225262

WN12-00-000200 - Windows PowerShell must be updated to a version that supports script block logging on Windows 2012/2012 R2.

Rule-ID|SV-225263r569185_rule

STIG-ID|WN12-00-000200

STIG-Legacy|SV-95179

STIG-Legacy|V-80473

Vuln-ID|V-225263

WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Enabled

800-53|AU-3(1)

CCI|CCI-000135

CSCv6|16.4

Rule-ID|SV-225264r569185_rule

STIG-ID|WN12-00-000210

STIG-Legacy|SV-95183

STIG-Legacy|V-80475

Vuln-ID|V-225264

WN12-00-000210 - PowerShell script block logging must be enabled on Windows 2012/2012 R2 - Patch

WN12-00-000220 - Windows PowerShell 2.0 must not be installed on Windows 2012/2012 R2.

Rule-ID|SV-225265r569185_rule

STIG-ID|WN12-00-000220

STIG-Legacy|SV-95185

STIG-Legacy|V-80477

Vuln-ID|V-225265

WN12-AC-000001 - Windows 2012 account lockout duration must be configured to 15 minutes or greater.

800-53|AC-7b.

CCI|CCI-002238

CSCv6|16.7

Rule-ID|SV-225266r569185_rule

STIG-ID|WN12-AC-000001

STIG-Legacy|SV-52850

STIG-Legacy|V-1099

Vuln-ID|V-225266

WN12-AC-000002 - The number of allowed bad logon attempts must meet minimum requirements.

800-53|AC-7a.

CCI|CCI-000044

Detections

Analytics

Revision 1.1

Oct 27, 2021

Functional Update