Win Server 2016 STIG Compliance

21 items · Security · Medium difficulty · 4 hours

Apply and verify the Windows Server 2016 STIG baseline with this practical compliance checklist.

• Install latest Windows Server 2016 patches

  Include security and cumulative updates; verify reboot windows are scheduled

• Apply DISA STIG Group Policy Objects (GPO)

  Baseline settings provided by DISA to enforce STIG controls

• Import DISA GPO package

  Use the provided GPO archive and verify SHA/hash

• Link STIG GPOs to appropriate OUs

  Apply GPOs to the correct organizational units for servers/DCs

• Run STIG compliance scan using SCAP/SCC tools

  Use DISA SCAP, SCC or equivalent content to generate a compliance report

• Review and remediate critical scan findings

  Triage high-severity findings first and patch/configure as required

• Disable SMBv1

  Turn off SMBv1 and verify file services use SMBv2/3

• Enable Windows Firewall and configure rules

  Allow only necessary inbound services and restrict management ports

• Enforce password and account lockout policies

  Set complexity, minimum length, maximum age, and lockout threshold

• Harden Remote Desktop Protocol (RDP) settings

  Enable NLA, restrict who can logon, and limit exposed ports

• Configure auditing and logging

  Enable audit policies and centralize logs for review

• Enable logon success/failure auditing

  Capture authentication events for incident detection

• Configure log retention and forwarding to SIEM

  Set retention, secure logs, and forward to your monitoring system

• Remove or disable unnecessary services and roles

  Minimize attack surface by removing unused components

• Limit local administrator accounts and implement LAPS or centralized admin

  Use unique local admin passwords or centralized privileged access

• Enable BitLocker for system volumes (if applicable)

  Encrypt OS and data volumes to protect data at rest

• Ensure secure time synchronization with authenticated NTP

  Use authenticated NTP sources for accurate logs and Kerberos

• Secure and monitor network shares and permissions

  Restrict share access, audit changes, and remove anonymous access

• Document deviations and exceptions with approvals

  Record justified exceptions, approval authority, and mitigation steps

• Schedule regular STIG scans and GPO updates

  Automate recurring scans and apply updated DISA resources when released

• Keep a copy of applied STIG version and GPO hashes for auditing

  Archive STIG files, SHA hashes, and change history for evidence

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.