Skip to content

Convert V-254444 to a manual rule #1530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MrAutomater wants to merge 3 commits into
base: 4.29.0
Choose a base branch
from
+148 −260
Open

Convert V-254444 to a manual rule #1530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d5cf5b3
Convert V-254444 to a Manual Rule
MrAutomater Dec 11, 2025
dba5e03
updated for 254444 as a manual stig
MrAutomater Dec 11, 2025
2f666d9
update org settings
MrAutomater Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ...igData/Archive/Windows.Server.2022/U_MS_Windows_Server_2022_MS_STIG_V2R5_Manual-xccdf.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ V-254443::DoD Root CA 3- DoD Interoperability Root CA 2 - 49CBE933151872E17C8EAE
V-254443::Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US::Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
V-254443::Thumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02::Thumbprint: 49CBE933151872E17C8EAE7F0ABA97FB610F6477
V-254443::NotAfter: 8/26/2022 9:25:51 AM::NotAfter: 11/16/2024
V-254444::*::''
V-254458::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'; ValueName = 'LegalNoticeCaption'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "'{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$'"}
V-254484::0x00000002 (2) (Prompt for consent on the secure desktop)::1 or 2
V-254490::0x00000002 (2) (or if the Value Name does not exist)::2
Expand Down
1 change: 1 addition & 0 deletions ...igData/Archive/Windows.Server.2022/U_MS_Windows_Server_2022_MS_STIG_V2R6_Manual-xccdf.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ V-254443::DoD Root CA 3- DoD Interoperability Root CA 2 - 49CBE933151872E17C8EAE
V-254443::Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US::Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
V-254443::Thumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02::Thumbprint: 49CBE933151872E17C8EAE7F0ABA97FB610F6477
V-254443::NotAfter: 8/26/2022 9:25:51 AM::NotAfter: 11/16/2024
V-254444::*::''
V-254458::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'; ValueName = 'LegalNoticeCaption'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "'{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$'"}
V-254484::0x00000002 (2) (Prompt for consent on the secure desktop)::1 or 2
V-254490::0x00000002 (2) (or if the Value Name does not exist)::2
Expand Down
218 changes: 82 additions & 136 deletions source/StigData/Processed/WindowsServer-2022-MS-2.5.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="MS_Windows_Server_2022_MS_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]." filename="U_MS_Windows_Server_2022_MS_STIG_V2R5_Manual-xccdf.xml" releaseinfo="Release: 5 Benchmark Date: 02 Jul 2025 3.5 1.10.0" title="Microsoft Windows Server 2022 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.5" created="8/28/2025">
<DISASTIG version="2" classification="UNCLASSIFIED" customname="" stigid="MS_Windows_Server_2022_MS_STIG" description="This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]." filename="U_MS_Windows_Server_2022_MS_STIG_V2R5_Manual-xccdf.xml" releaseinfo="Release: 5 Benchmark Date: 02 Jul 2025 3.5 1.10.0" title="Microsoft Windows Server 2022 Security Technical Implementation Guide" notice="terms-of-use" source="STIG.DOD.MIL" fullversion="2.5" created="12/11/2025">
<AccountPolicyRule dscresourcemodule="SecurityPolicyDsc">
<Rule id="V-254285" severity="medium" conversionstatus="pass" title="SRG-OS-000329-GPOS-00128" dscresource="AccountPolicy">
<Description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
Expand Down Expand Up @@ -1308,7 +1308,7 @@ Navigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Admin

Verify LAPS Operational logs &gt;&gt; Event Viewer &gt;&gt; Applications and Services Logs &gt;&gt; Microsoft &gt;&gt; Windows &gt;&gt; LAPS &gt;&gt; Operational. Verify LAPS policy process is completing. If it is not, this is a finding.

If the server is not a member of a domain this not applicable.</RawString>
If the server is not a member of a domain this is not applicable.</RawString>
</Rule>
<Rule id="V-254240" severity="high" conversionstatus="pass" title="SRG-OS-000480-GPOS-00227" dscresource="None">
<Description>&lt;VulnDiscussion&gt;Using applications that access the internet or have potential internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.
Expand Down Expand Up @@ -1835,6 +1835,66 @@ Standard user accounts must not be members of the local Administrator group.
If accounts that do not have responsibility for administration of the system are members of the local Administrators group, this is a finding.

If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.</RawString>
</Rule>
<Rule id="V-254444" severity="medium" conversionstatus="pass" title="SRG-OS-000066-GPOS-00034" dscresource="None">
<Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DOD websites due to the system chaining to a root other than DOD Root CAs, the US DOD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
<DuplicateOf />
<IsNullOrEmpty>False</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<OrganizationValueRequired>False</OrganizationValueRequired>
<OrganizationValueTestString />
<RawString>This is applicable to unclassified systems. It is NA for others.

Open "PowerShell" as an administrator.

Execute the following command:

Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter

If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding.

Subject: CN=DOD Root CA 3, OU=PKI, OU=DOD, O=U.S. Government, C=US
Issuer: CN=US DOD CCEB Interoperability Root CA 2, OU=PKI, OU=DOD, O=U.S. Government, C=US
Thumbprint: 9B74964506C7ED9138070D08D5F8B969866560C8
NotAfter: 7/18/2025 9:56:22 AM

Alternately, use the Certificates MMC snap-in:

Run "MMC".

Select "File", "Add/Remove Snap-in".

Select "Certificates" and click "Add".

Select "Computer account" and click "Next".

Select "Local computer: (the computer this console is running on)" and click "Finish".

Click "OK".

Expand "Certificates" and navigate to Untrusted Certificates &gt;&gt; Certificates.

For each certificate with "US DOD CCEB Interoperability Root CA ..." under "Issued By":

Right-click on the certificate and select "Open".

Select the "Details" tab.

Scroll to the bottom and select "Thumbprint".

If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.

Issued To: DOD Root CA 3
Issued By: US DOD CCEB Interoperability Root CA 2
Thumbprint: 9B74964506C7ED9138070D08D5F8B969866560C8
NotAfter: 7/18/2025
Issued to: DOD Root CA 6
Issued By: US DOD CCEB Interoperability Root CA 2
Thumbprint: D471CA32F7A692CE6CBB6196BD3377FE4DBCD106
NotAfter: 7/18/2026</RawString>
</Rule>
<Rule id="V-254282" severity="medium" conversionstatus="pass" title="SRG-OS-000480-GPOS-00227" dscresource="None">
<Description>&lt;VulnDiscussion&gt;Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
Expand Down Expand Up @@ -5451,8 +5511,8 @@ Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182&lt;/VulnDiscussion
<Location />
<OrganizationValueRequired>True</OrganizationValueRequired>
<OrganizationValueTestString>location for DoD Root CA 6 certificate is present</OrganizationValueTestString>
<RawString>DoD Root CA 6,D37ECF61C0B4ED88681EF3630C4E2FC787B37AEF</RawString>
<Thumbprint>D37ECF61C0B4ED88681EF3630C4E2FC787B37AEF</Thumbprint>
<RawString>DoD Root CA 6,D37ECF61C0B4ED88681EF3630C4E2FC787B37AEFB</RawString>
<Thumbprint>D37ECF61C0B4ED88681EF3630C4E2FC787B37AEFB</Thumbprint>
</Rule>
<Rule id="V-254443" severity="medium" conversionstatus="pass" title="SRG-OS-000066-GPOS-00034" dscresource="CertificateDSC">
<CertificateName>DoD Interoperability Root CA 2</CertificateName>
Expand Down Expand Up @@ -5513,126 +5573,6 @@ Thumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02
Valid to: Wednesday, November 16, 2024</RawString>
<Thumbprint>49CBE933151872E17C8EAE7F0ABA97FB610F6477</Thumbprint>
</Rule>
<Rule id="V-254444.a" severity="medium" conversionstatus="pass" title="SRG-OS-000066-GPOS-00034" dscresource="CertificateDSC">
<CertificateName />
<Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DOD websites due to the system chaining to a root other than DOD Root CAs, the US DOD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
<DuplicateOf />
<IsNullOrEmpty>False</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<Location />
<OrganizationValueRequired>False</OrganizationValueRequired>
<OrganizationValueTestString />
<RawString>This is applicable to unclassified systems. It is NA for others.

Open "PowerShell" as an administrator.

Execute the following command:

Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter

If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding.

Subject: CN=DOD Root CA 3, OU=PKI, OU=DOD, O=U.S. Government, C=US
Issuer: CN=US DOD CCEB Interoperability Root CA 2, OU=PKI, OU=DOD, O=U.S. Government, C=US
Thumbprint: 9B74964506C7ED9138070D08D5F8B969866560C8
NotAfter: 7/18/2025 9:56:22 AM

Alternately, use the Certificates MMC snap-in:

Run "MMC".

Select "File", "Add/Remove Snap-in".

Select "Certificates" and click "Add".

Select "Computer account" and click "Next".

Select "Local computer: (the computer this console is running on)" and click "Finish".

Click "OK".

Expand "Certificates" and navigate to Untrusted Certificates then Certificates.

For each certificate with "US DOD CCEB Interoperability Root CA ..." under "Issued By":

Right-click on the certificate and select "Open".

Select the "Details" tab.

Scroll to the bottom and select "Thumbprint".

If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.

Issued To: DOD Root CA 3
Issued By: US DOD CCEB Interoperability Root CA 2
Thumbprint: 9B74964506C7ED9138070D08D5F8B969866560C8
NotAfter: 7/18/2025
</RawString>
<Thumbprint>9B74964506C7ED9138070D08D5F8B969866560C8</Thumbprint>
</Rule>
<Rule id="V-254444.b" severity="medium" conversionstatus="pass" title="SRG-OS-000066-GPOS-00034" dscresource="CertificateDSC">
<CertificateName />
<Description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DOD websites due to the system chaining to a root other than DOD Root CAs, the US DOD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</Description>
<DuplicateOf />
<IsNullOrEmpty>False</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<Location />
<OrganizationValueRequired>False</OrganizationValueRequired>
<OrganizationValueTestString />
<RawString>This is applicable to unclassified systems. It is NA for others.

Open "PowerShell" as an administrator.

Execute the following command:

Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter

If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding.

Subject: CN=DOD Root CA 3, OU=PKI, OU=DOD, O=U.S. Government, C=US
Issuer: CN=US DOD CCEB Interoperability Root CA 2, OU=PKI, OU=DOD, O=U.S. Government, C=US
Thumbprint: 9B74964506C7ED9138070D08D5F8B969866560C8
NotAfter: 7/18/2025 9:56:22 AM

Alternately, use the Certificates MMC snap-in:

Run "MMC".

Select "File", "Add/Remove Snap-in".

Select "Certificates" and click "Add".

Select "Computer account" and click "Next".

Select "Local computer: (the computer this console is running on)" and click "Finish".

Click "OK".

Expand "Certificates" and navigate to Untrusted Certificates then Certificates.

For each certificate with "US DOD CCEB Interoperability Root CA ..." under "Issued By":

Right-click on the certificate and select "Open".

Select the "Details" tab.

Scroll to the bottom and select "Thumbprint".

If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding.


Issued to: DOD Root CA 6
Issued By: US DOD CCEB Interoperability Root CA 2
Thumbprint: D471CA32F7A692CE6CBB6196BD3377FE4DBCD106
NotAfter: 7/18/2026</RawString>
<Thumbprint>D471CA32F7A692CE6CBB6196BD3377FE4DBCD106</Thumbprint>
</Rule>
</RootCertificateRule>
<SecurityOptionRule dscresourcemodule="SecurityPolicyDsc">
<Rule id="V-254465" severity="high" conversionstatus="pass" title="SRG-OS-000480-GPOS-00227" dscresource="SecurityOption">
Expand Down Expand Up @@ -5997,8 +5937,9 @@ The "Enable computer and user accounts to be trusted for delegation" user right
<DisplayName>Enable computer and user accounts to be trusted for delegation</DisplayName>
<DuplicateOf />
<Force>True</Force>
<Identity>NULL</Identity>
<IsNullOrEmpty>False</IsNullOrEmpty>
<Identity>
</Identity>
<IsNullOrEmpty>True</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<OrganizationValueRequired>False</OrganizationValueRequired>
Expand All @@ -6023,8 +5964,9 @@ Accounts with the "Access Credential Manager as a trusted caller" user right may
<DisplayName>Access Credential Manager as a trusted caller</DisplayName>
<DuplicateOf />
<Force>True</Force>
<Identity>NULL</Identity>
<IsNullOrEmpty>False</IsNullOrEmpty>
<Identity>
</Identity>
<IsNullOrEmpty>True</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<OrganizationValueRequired>False</OrganizationValueRequired>
Expand All @@ -6047,8 +5989,9 @@ Accounts with the "Act as part of the operating system" user right can assume th
<DisplayName>Act as part of the operating system</DisplayName>
<DuplicateOf />
<Force>True</Force>
<Identity>NULL</Identity>
<IsNullOrEmpty>False</IsNullOrEmpty>
<Identity>
</Identity>
<IsNullOrEmpty>True</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<OrganizationValueRequired>False</OrganizationValueRequired>
Expand Down Expand Up @@ -6149,8 +6092,9 @@ The "Create a token object" user right allows a process to create an access toke
<DisplayName>Create a token object</DisplayName>
<DuplicateOf />
<Force>True</Force>
<Identity>NULL</Identity>
<IsNullOrEmpty>False</IsNullOrEmpty>
<Identity>
</Identity>
<IsNullOrEmpty>True</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<OrganizationValueRequired>False</OrganizationValueRequired>
Expand Down Expand Up @@ -6202,8 +6146,9 @@ Accounts with the "Create permanent shared objects" user right could expose sens
<DisplayName>Create permanent shared objects</DisplayName>
<DuplicateOf />
<Force>True</Force>
<Identity>NULL</Identity>
<IsNullOrEmpty>False</IsNullOrEmpty>
<Identity>
</Identity>
<IsNullOrEmpty>True</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<OrganizationValueRequired>False</OrganizationValueRequired>
Expand Down Expand Up @@ -6414,8 +6359,9 @@ Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000433-GPOS-00193&lt;/VulnDiscussion
<DisplayName>Lock pages in memory</DisplayName>
<DuplicateOf />
<Force>True</Force>
<Identity>NULL</Identity>
<IsNullOrEmpty>False</IsNullOrEmpty>
<Identity>
</Identity>
<IsNullOrEmpty>True</IsNullOrEmpty>
<LegacyId>
</LegacyId>
<OrganizationValueRequired>False</OrganizationValueRequired>
Expand Down
Loading