Windows Server 2025 STIG

22 items · Security · Hard difficulty · 1 week

Essential steps to harden Windows Server 2025 and apply the DISA STIG.

• Download official Windows Server 2025 STIG from DoD Cyber Exchange

  Grab XCCDF and STIG docs from cyber.mil or public.cyber.mil for non-CAC users.

• Inventory servers and classify as Domain Controller or Member Server

  Record hostname, role, OS build, IP, and physical or virtual location.

• Backup system state and critical data before applying changes

  Use verified backups and test restore points before remediation.

• Apply latest Windows Updates and security patches

  Install cumulative updates and security patches, then reboot if required.

• Enable and configure Windows Firewall with least-privilege rules

  Create explicit inbound rules scoped to services and source IPs.

• Set account policies: enforce password complexity and lockouts

  Configure GPO password length, complexity, rotation, and lockout thresholds.

• Enable multi-factor authentication for privileged accounts

  Require MFA for admin and remote access to reduce credential risk.

• Disable or remove unnecessary services and legacy protocols

  Remove Telnet, SMBv1, and unused server roles and features.

• Secure Remote Desktop access: enforce NLA and restrict access

  Disable RDP where not required; use jump hosts and firewall rules.

• Configure Audit Policy and enable advanced auditing

  Log account changes, logon events, policy modifications, and retention.

• Apply baseline Group Policy settings per the STIG

  Import STIG GPO templates and link them to appropriate OUs.

• Harden Domain Controllers
• Restrict domain controller administrative accounts and use dedicated workstations

  Limit admin logins to jump/bastion systems and approve exceptions.

• Enable secure replication and protect recovery modes

  Harden AD replication channels and secure Directory Services Restore Mode.

• Deploy Local Administrator Password Solution (LAPS) on DCs

  Rotate local admin passwords and store them securely in AD.

• Enable BitLocker and Secure Boot on physical and supported virtual hosts

  Protect OS volumes with TPM-backed BitLocker where feasible.

• Configure Endpoint Protection and enable tamper protection

  Ensure antivirus/EDR is installed, updated, and tamper-protected.

• Disable legacy authentication protocols (SMBv1, NTLMv1)

  Block or remove deprecated protocols across the estate.

• Run STIG compliance scan (XCCDF/SCAP) and generate remediation report

  Use DISA STIG tools or SCAP Workbench to list and prioritize findings.

• Perform vulnerability scans and document exceptions

  Scan with approved tools, log findings, and record approved exceptions.

• Document all changes, maintain a change log and contact information

  Record who made changes, when, and why for auditability.

• Implement continuous monitoring and integrate logs into SIEM

  Forward events, set alerting rules, and review dashboards regularly.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.