Windows 10 STIG Checklist (v3, r7)

18 items · Security · Hard difficulty · 4 hours

Implement the DISA Windows 10 STIG baseline step-by-step.

• Download STIG resources (SCAP, XCCDF, GPOs, Intune)

  Get official DISA SCAP, XCCDF, GPO and Intune policy files and SHA checksums.

• Verify system edition and OS build

  Confirm Windows 10 Enterprise or compatible build before applying Enterprise-only controls.

• Inventory existing Group Policy Objects and settings

  Document current GPOs and deviations to plan rollbacks or merges.

• Backup current system state and GPOs

  Create system restore points and export GPOs before changes.

• Apply baseline GPOs from the DISA package

  Import and link the provided GPOs to target OUs per guidance.

• Import Intune policies for managed devices

  Deploy Intune configurations provided in the STIG package for enrolled devices.

• Check TPM and Secure Boot support

  Verify TPM presence and UEFI Secure Boot for BitLocker readiness.

• Enable BitLocker on system drives

  Turn on BitLocker with TPM and recovery key backup to AD or M365.

• Enable Windows Firewall and verify outbound rules

  Ensure firewall is active and restrictive outbound rules are configured.

• Configure Windows Defender and antivirus settings

  Enable real-time protection, cloud-delivery, and periodic scanning per STIG.

• Configure account lockout and password policies

  Set lockout thresholds, durations, and password complexity per guidance.

• Disable unnecessary services and legacy features

  Remove or disable legacy protocols and unused services to reduce attack surface.

• Disable SMBv1

  Turn off SMBv1 protocol on all systems.

• Disable LLMNR

  Disable Link-Local Multicast Name Resolution to prevent name spoofing.

• Uninstall Telnet and legacy remote tools

  Remove telnet, outdated components and unused remote services.

• Configure Windows Update and automatic patching

  Set update cadence, automatic install, and maintenance windows.

• Enable auditing and centralize log collection

  Turn on recommended audit policies and forward logs to SIEM or collector.

• Run SCAP/compliance scan and remediate findings

  Scan with DISA SCAP/XCCDF and address noncompliant items per STIG fixes.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.