Microsoft Windows Defender Firewall STIG Checklist (Ver 2, Rel 2)

19 items · Security · Medium difficulty · 2 hours

Apply and verify the Windows Defender Firewall STIG for secure, compliant systems.

• Download STIG and supporting resources

  Collect SCAP, XCCDF, GPO, Intune, and SCC files for the STIG version.

• Download SCAP 1.2 content for the STIG

  Get the SCAP 1.2 package (verify Ver 2, Rel 2 or newer).

• Download standalone XCCDF content

  Grab the XCCDF 1.1.4 file to run benchmark scans and reports.

• Download DISA GPO package

  Download the supplied GPOs for automated Group Policy deployment.

• Download Intune policies

  Get the Intune policy pack for managed endpoints (verify date/version).

• Download SCC/automated content

  Obtain SCC or other automation tooling for deployment and scanning.

• Review the STIG and map requirements to your environment

  Identify applicable controls and the systems they affect.

• Verify target systems meet STIG scope and prerequisites

  Check OS versions, service packs, and HIP capability before applying STIGs.

• Backup current firewall configuration and export existing GPOs

  Export GPOs and save firewall config backups before changes.

• Import DISA GPO package into Group Policy Management

  Load the downloaded GPOs into your AD environment.

• Apply STIG firewall baseline via GPO to target OUs

  Link and enforce the imported GPOs on the designated organizational units.

• Deploy DISA Intune policies to targeted device groups

  Publish Intune configurations to managed device groups as applicable.

• Enable firewall logging and auditing per STIG guidance

  Turn on dropped packet and connection logging and forward logs to collectors.

• Set default inbound/outbound behavior and configure exceptions

  Enforce default deny inbound and required outbound rules; document exceptions.

• Restrict firewall rule scope to required IPs and interfaces

  Limit rules by source/destination addresses and network interfaces.

• Run SCAP/XCCDF scans and verify STIG compliance

  Use downloaded SCAP/XCCDF to generate compliance reports and findings.

• Test critical applications and network connectivity after changes

  Validate business apps and services remain functional post-deployment.

• Document configuration changes and collect approval artifacts

  Record changes, baseline snapshots, and sign-off evidence for audits.

• Monitor firewall logs and tune rules over the next 30 days

  Review logs, adjust rules, and set alerts to reduce false positives.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.