Windows Server 2025 STIG Checklist

17 items · Security · Hard difficulty · 3 hours

Essential STIG checklist to secure Windows Server 2025 for admins and auditors.

• Download standalone XCCDF 1.1.4 for Microsoft Windows Server 2025 STIG

  Get the DISA XCCDF package for automated scanning.

• Obtain the official STIG documents from DoD Cyber Exchange or public.cyber.mil

  Retrieve STIGs, SRGs, and references for guidance.

• Inventory Windows Server 2025 hosts and classify each as domain controller or member/standalone

  List hostnames, roles, OS builds, and IPs.

• Enroll servers in centralized management (e.g., SCCM, WSUS, or equivalent)

  Ensure devices are managed for patching and configuration control.

• Scan servers with an XCCDF/SCAP tool using the downloaded STIG checklist

  Run automated checks to identify configuration deviations.

• Review scan findings and prioritize high-severity issues

  Triage by severity and mission impact before remediation.

• Remediate high-severity findings and document actions taken

  Apply fixes, change configurations, or implement mitigations.

• Harden domain controllers

  Apply DC-specific controls from the STIG to domain controllers.

• Apply DC-specific STIG settings (STIG IDs with 'DC' as second component)

  Follow STIG items labeled for domain controllers.

• Verify AD replication, privileged account protections, and audit settings on DCs

  Confirm replication, auditing, and privileged account controls are enforced.

• Harden member and standalone servers

  Apply server-specific STIG controls for non-DC hosts.

• Apply MS-specific STIG settings to member/standalone servers (STIG IDs with 'MS')

  Implement the controls designated for member servers.

• Configure centralized logging and forward security events to a SIEM

  Ensure retention and centralized analysis of security logs.

• Implement patch management and verify systems meet DoDI 8500.01 requirements

  Validate patch baselines and reporting across servers.

• Restrict administrative access and implement least privilege

  Limit admin accounts and use privileged access management tools.

• Document exceptions, request waivers for justified deviations, and track approvals

  Record rationale, compensating controls, and approval records.

• Schedule periodic reassessments and update controls when the STIG/NIST checklist is revised

  Set recurring scans and review dates to maintain compliance.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.