Home
Security Hardening
DISA Windows Server 2012 And 2012 R2 DC STIG V3R3

DISA Windows Server 2012 And 2012 R2 DC STIG V3R3

WN12-00-000001 – Server systems must be located in a controlled access area, accessible only to authorized personnel.
Details Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality,...
WN12-00-000004 – Users with administrative privilege must be documented.
Details Administrative accounts may perform any action on a system. Users with administrative accounts must be documented to ensure those...
WN12-00-000005 – Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.
Details Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a...
WN12-00-000006 – Policy must require that system administrators (SAs) be trained for the operating systems used by systems under their control.
Details If SAs are assigned to systems running operating systems for which they have no training, these systems are at...
WN12-00-000007 – Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization.
Details The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the...
WN12-00-000008 – Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.
Details Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise....
WN12-00-000009-01 – Members of the Backup Operators group must be documented.
Details Backup Operators are able to read and write to any file in the system, regardless of the rights assigned...
WN12-00-000009-02 – Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.
Details Backup Operators are able to read and write to any file in the system, regardless of the rights assigned...
WN12-00-000010 – Policy must require application account passwords be at least 15 characters in length.
Details Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed...
WN12-00-000011 – Windows 2012/2012 R2 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.
Details Setting application accounts to expire may cause applications to stop functioning. However, not changing them on a regular basis...

DISA Windows Server 2012 And 2012 R2 DC STIG V3R3

WN12-00-000001 – Server systems must be located in a controlled access area, accessible only to authorized personnel.

WN12-00-000004 – Users with administrative privilege must be documented.

WN12-00-000005 – Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.

WN12-00-000006 – Policy must require that system administrators (SAs) be trained for the operating systems used by systems under their control.

WN12-00-000007 – Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization.

WN12-00-000008 – Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.

WN12-00-000009-01 – Members of the Backup Operators group must be documented.

WN12-00-000009-02 – Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.

WN12-00-000010 – Policy must require application account passwords be at least 15 characters in length.

WN12-00-000011 – Windows 2012/2012 R2 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.