# stig_rules

vuln_id: V-223312
rule_id: SV-223312r961086_rule
severity: CAT II
title: Dynamic Data Exchange (DDE) server launch in Excel must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to control whether Dynamic Data Exchange (DDE) server launch is allowed.

  By default, DDE server launch is turned off, but users can turn on DDE server launch by going to File >> Options >> Trust Center >> Trust Center Settings >> External Content.

  For security reasons, turning on DDE server launch is not recommended.

  Note: For DDE server launch to work, Dynamic Data Exchange (DDE) server lookup must be turned on. Be sure that the “Don't allow Dynamic Data Exchange (DDE) server lookup” policy setting is not enabled, because enabling that policy setting turns off DDE server lookup.

  If you enable this policy setting, DDE server launch is not allowed, and users cannot turn on DDE server launch in the Trust Center.

  If you disable this policy setting, DDE server launch is allowed, and users cannot turn off DDE server launch in the Trust Center. For security reasons, this is not recommended.

  If you do not configure this policy setting, DDE server launch is turned off, but users can turn on DDE server launch in the Trust Center.

  Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server launch in Excel to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server launch in Excel is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\excel\security\external content

  If the value for "disableddeserverlaunch" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223313
rule_id: SV-223313r961086_rule
severity: CAT II
title: Dynamic Data Exchange (DDE) server lookup in Excel must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to control whether Dynamic Data Exchange (DDE) server lookup is allowed.

  By default, DDE server lookup is turned on, but users can turn off DDE server lookup by going to File >> Options >> Trust Center >> Trust Center Settings >> External Content.

  If you enable this policy setting, DDE server lookup is not allowed, and users cannot turn on DDE server lookup in the Trust Center.

  Note: If you are using Dynamic Data Exchange (DDE) server launch, which is not recommended, do not enable this policy setting, because DDE server launch requires DDE server lookup to be on.

  If you disable or do not configure this policy setting, DDE server lookup is turned on, but users can turn off DDE server lookup in the Trust Center.

  Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server lookup in Excel to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server lookup in Excel is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\excel\security\external content

  If the value for "disableddeserverlookup" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223314
rule_id: SV-223314r961086_rule
severity: CAT II
title: Open/save of dBase III / IV format files must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.

  If you enable this policy setting, you can specify whether users can open, view, edit, or save files.

  The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "dBase III / IV files" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "dBase III / IV files" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value DBaseFiles is REG_DWORD = 2, this is not a finding.


vuln_id: V-223315
rule_id: SV-223315r961086_rule
severity: CAT II
title: Open/save of Dif and Sylk format files must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. 

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Dif and Sylk files" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Dif and Sylk files" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value DifandSylkFiles is REG_DWORD = 2, this is not a finding.


vuln_id: V-223316
rule_id: SV-223316r961086_rule
severity: CAT II
title: Open/save of Excel 2 macrosheets and add-in files must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. 

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 macrosheets and add-in files" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 macrosheets and add-in files" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value XL2Macros is REG_DWORD = 2, this is not a finding.


vuln_id: V-223317
rule_id: SV-223317r961086_rule
severity: CAT II
title: Open/save of Excel 2 worksheets must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. 

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 worksheets" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 worksheets" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value XL2Worksheets is REG_DWORD = 2, this is not a finding.


vuln_id: V-223318
rule_id: SV-223318r961086_rule
severity: CAT II
title: Open/save of Excel 3 macrosheets and add-in files must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1531 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 macrosheets and add-in files" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 macrosheets and add-in files" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value XL3Macros is REG_DWORD = 2, this is not a finding.


vuln_id: V-223319
rule_id: SV-223319r961086_rule
severity: CAT II
title: Open/save of Excel 3 worksheets must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 worksheets" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 worksheets" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value XL3Worksheets is REG_DWORD = 2, this is not a finding.


vuln_id: V-223320
rule_id: SV-223320r961086_rule
severity: CAT II
title: Open/save of Excel 4 macrosheets and add-in files must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1531 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 macrosheets and add-in files" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 macrosheets and add-in files" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value XL4Macros is REG_DWORD = 2, this is not a finding.


vuln_id: V-223321
rule_id: SV-223321r961086_rule
severity: CAT II
title: Open/save of Excel 4 workbooks must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 workbooks" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 workbooks" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value XL4Workbooks is REG_DWORD = 2, this is not a finding.


vuln_id: V-223322
rule_id: SV-223322r961086_rule
severity: CAT II
title: Open/save of Excel 4 worksheets must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1531 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 worksheets" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 worksheets" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value XL4Worksheets is REG_DWORD = 2, this is not a finding.


vuln_id: V-223323
rule_id: SV-223323r961086_rule
severity: CAT II
title: Open/save of Excel 95 workbooks must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1531 characters]

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Excel 95 workbooks to "Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Excel 95 workbooks is set to "Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\excel\security\fileblock

  If the value for xl95workbooks is REG_DWORD = 2, this is not a finding.


vuln_id: V-223324
rule_id: SV-223324r961086_rule
severity: CAT II
title: Open/save of Excel 95-97 workbooks and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1531 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 95-97 workbooks and templates" to "Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 95-97 workbooks and templates" is set to "Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\office\16.0\excel\security\fileblock

  If the value XL9597WorkbooksandTemplates is REG_DWORD = 2, this is not a finding.


vuln_id: V-223325
rule_id: SV-223325r961086_rule
severity: CAT II
title: The default file block behavior must be set to not open blocked files in Excel.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1531 characters]

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Set default file block behavior to "Enabled:Blocked files are not opened".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Set default file block behavior is set to "Blocked files are not opened".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock

  If the value OpenInProtectedView is REG_DWORD = 0, this is not a finding.


vuln_id: V-223326
rule_id: SV-223326r961086_rule
severity: CAT II
title: Open/save of Web pages and Excel 2003 XML spreadsheets must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1531 characters]

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Web pages and Excel 2003 XML spreadsheets to "Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Web pages and Excel 2003 XML spreadsheets is set to "Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security\fileblock

  If the value for htmlandxmlssfiles is REG_DWORD = 2, this is not a finding.


vuln_id: V-223327
rule_id: SV-223327r961086_rule
severity: CAT II
title: Extraction options must be blocked when opening corrupt Excel workbooks.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Excel presents users with a list of data extraction options before beginning an Open and Repair operation when users choose to open a corrupt workbook in repair or extract mode.

  If you enable this policy setting, Excel opens the file using the Safe Load process and does not prompt users to choose between repairing or extracting data.

  If you disable or do not configure this policy setting, Excel prompts the user to select either to repair or to extract data, and to select either to convert to values or to recover formulas.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Data Recovery >> Do not show data extraction options when opening corrupt workbooks to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Data Recovery >> Do not show data extraction options when opening corrupt workbooks is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\options

  If the value for extractdatadisableui is REG_DWORD = 1, this is not a finding.


vuln_id: V-223328
rule_id: SV-223328r961092_rule
severity: CAT II
title: Updating of links in Excel must be prompted and not automatic.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Excel prompts users to update automatic links, or whether the updates occur in the background with no prompt.

  If you enable or do not configure this policy setting, Excel will prompt users to update automatic links. In addition, the "Ask to update automatic links" user interface option under File tab >> Advanced >> General is selected.

  If you disable this policy setting, Excel updates automatic links without prompting or informing users, which could compromise the integrity of some of the information in the workbook.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Ask to update automatic links to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Ask to update automatic links is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\options\binaryoptions

  If the value for fupdateext_78_1 is REG_DWORD = 0, this is not a finding.


vuln_id: V-223329
rule_id: SV-223329r961779_rule
severity: CAT II
title: Loading of pictures from Web pages not created in Excel must be disabled.
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Excel loads graphics when opening Web pages that were not created in Excel. It configures the "Load pictures from Web pages not created in Excel" option under the File tab >> Options >> Advanced >> General >> Web Options... >> General tab.

  If you enable or do not configure this policy setting, Excel loads any graphics that are included in the pages, regardless of whether they were originally created in Excel.

  If you disable this policy setting, Excel will not load any pictures from Web pages that were not created in Excel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Web Options... >> General >> Load pictures from Web pages not created in Excel to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Web Options... >> General.

  Load pictures from Web pages not created in Excel is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\internet

  If the value for donotloadpictures is REG_DWORD = 1, this is not a finding.


vuln_id: V-223330
rule_id: SV-223330r961863_rule
severity: CAT II
title: AutoRepublish in Excel must be disabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows administrators to disable the AutoRepublish feature in Excel. If users choose to publish Excel data to a static Web page and enable the AutoRepublish feature, Excel saves a copy of the data to the Web page every time the user saves the workbook. By default, a message dialog displays every time the user saves a published workbook when AutoRepublish is enabled. From this dialog, the user can disable AutoRepublish temporarily or permanently, or select "Do not show this message again" to prevent the dialog from appearing after every save. If the user selects "Do not show this message again", Excel will continue to automatically republish the data after every save without informing the user.

  If you enable this policy setting, the AutoRepublish feature is turned off and Excel users will need to publish data to the Web manually.

  If you disable or do not configure this policy setting, users can enable the AutoRepublish feature to automatically republish workbooks saved as type Web Page.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Disable AutoRepublish to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Disable AutoRepublish is to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\excel\options

  If the value for disableautorepublish is REG_DWORD = 1, this is not a finding.


vuln_id: V-223331
rule_id: SV-223331r961863_rule
severity: CAT II
title: AutoRepublish warning alert in Excel must be enabled.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows administrators to disable the AutoRepublish feature in Excel. If users choose to publish Excel data to a static Web page and enable the AutoRepublish feature, Excel saves a copy of the data to the Web page every time the user saves the workbook. By default, a message dialog displays every time the user saves a published workbook when AutoRepublish is enabled. From this dialog, the user can disable AutoRepublish temporarily or permanently, or select "Do not show this message again" to prevent the dialog from appearing after every save. If the user selects "Do not show this message again", Excel will continue to automatically republish the data after every save without informing the user.
   
  If you enable this policy setting, the AutoRepublish feature is turned off and Excel users will need to publish data to the Web manually.
   
  If you disable or do not configure this policy setting, users can enable the AutoRepublish feature to automatically republish workbooks saved as type Web Page.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Do not show AutoRepublish warning alert to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Do not show AutoRepublish warning alert is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\excel\options

  If value for disableautorepublishwarning is REG_DWORD = 0, this is not a finding.


vuln_id: V-223332
rule_id: SV-223332r961863_rule
severity: CAT II
title: File extensions must be enabled to match file types in Excel.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how Excel loads file types that do not match their extension. Excel can load files with extensions that do not match the files' type. For example, if a comma-separated values (CSV) file named example.csv is renamed example.xls (or any other file extension supported by Excel 2003 and earlier only), Excel can properly load it as a CSV file.

  If you enable this policy setting, you can choose from three options for working with files that have non-matching extensions:
  - Allow different - Excel opens the files properly without warning users that the files have non-matching extensions. If users subsequently edit and save the files, Excel preserves both the true, underlying file format and the incorrect file extension.
  - Allow different, but warn - Excel opens the files properly, but warns users about the file type mismatch. This option is the default configuration in Excel.
  - Always match file type - Excel does not open any files that have non-matching extensions.

  If this policy setting is disabled or not configured or if users attempt to open files with the wrong extension, Excel opens the file and displays a warning that the file type is not what Excel expected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Force file extension to match file type to "Enabled" and select the option "Always match file type".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Force file extension to match file type is set to "Always match file type".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\excel\security

  If value for extensionhardening is REG_DWORD = 2, this is not a finding.


vuln_id: V-223333
rule_id: SV-223333r961092_rule
severity: CAT II
title: Scan of encrypted macros in Excel Open XML workbooks must be enabled.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether encrypted macros in Open XML workbooks be are required to be scanned with anti-virus software before being opened.

  If you enable this policy setting, you may choose one of these options:
  - Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.
  - Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load.
  - Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

  If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Scan encrypted macros in Excel Open XML workbooks to "Scan encrypted macros (default)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Scan encrypted macros in Excel Open XML workbooks is set to "Scan encrypted macros (default)".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security

  If the value excelbypassencryptedmacroscan does not exist, this is not a finding.

  If the value for excelbypassencryptedmacroscan is REG_DWORD = 0, this is not a finding.


vuln_id: V-223334
rule_id: SV-223334r960921_rule
severity: CAT II
title: File validation in Excel must be enabled.
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you turn off the file validation feature.

  If you enable this policy setting, file validation will be turned off.

  If you disable or do not configure this policy setting, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform against the file format schema before they are opened.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Turn off file validation to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Turn off file validation is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security\filevalidation

  If the value for enableonload is REG_DWORD = 1, this is not a finding.


vuln_id: V-223335
rule_id: SV-223335r961086_rule
severity: CAT II
title: WEBSERVICE Function Notification in Excel must be configured to disable all, with notifications.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how Excel will warn users when WEBSERVICE functions are present.

  If you enable this policy setting, you can choose from three options for determining how the specified applications will warn the user about WEBSERVICE functions:
  - Disable all with notification: The application displays the Trust Bar for all WEBSERVICE functions. This option enforces the default configuration in Office.
  - Disable all without notification: The application disables all WEBSERVICE functions and does not notify users.
  - Enable all WEBSERVICE functions (not recommended): The application enables all WEBSERVICE functions and does not notify users. This option can significantly reduce security by allowing information disclosure to third-party web services.

  If you disable this policy setting, the “Disable all with notification” will be the default setting.

  If you do not configure this policy setting, when users open workbooks that contain WEBSERVICE functions, Excel will open the files with the WEBSERVICE functions disabled and display the Trust Bar with a warning that WEBSERVICE functions are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content," then the document is added as a trusted document.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> WEBSERVICE Function Notification Settings to "Enabled" and "Disable all with notification".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> WEBSERVICE Function Notification Settings is set to "Enabled" and "Disable all with notification".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security

  If the value webservicefunctionwarnings does not exist, this is not a finding.

  If the value for webservicefunctionwarnings is REG_DWORD = 1, this is not a finding.

  If the value for webservicefunctionwarnings is REG_DWORD = 2, this is a finding.


vuln_id: V-223336
rule_id: SV-223336r961092_rule
severity: CAT II
title: Macros must be blocked from running in Excel files from the Internet.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet.

  If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content”, users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

  If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security

  If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.


vuln_id: V-223337
rule_id: SV-223337r1016168_rule
severity: CAT II
title: Trust Bar notification must be enabled for unsigned application add-ins in Excel and blocked.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the specified Office 2016 applications notify users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if the ''Require that application add-ins are signed by Trusted Publisher'' policy setting is enabled, which prevents users from changing this policy setting.

  If this policy setting is enabled, applications automatically disable unsigned add-ins without informing users.
   
  If this policy setting is disabled, if an application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.

  If this policy setting is not configured, the disable behavior applies, and in addition, users can configure this requirement themselves in the ''Add-ins'' category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security

  If the value for notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.


vuln_id: V-223338
rule_id: SV-223338r961086_rule
severity: CAT II
title: Untrusted Microsoft Query files must be blocked from opening in Excel.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Microsoft Query files (.iqy, oqy, .dqy, and .rqy) in an untrusted location are prevented from opening.

  If you enable this policy setting, Microsoft Query files in an untrusted location are prevented from opening. Users will not be able to change this setting under File >> Options >> Trust Center >> Trust Center Settings >> External Content.

  If you disable or do not configure this policy setting, Microsoft Query files in an untrusted location are not prevented from opening, unless users have changed this setting in the Trust Center.

  Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Always prevent untrusted Microsoft Query files from opening to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Always prevent untrusted Microsoft Query files from opening is set to "Enabled".
  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\external content.
  Value for enableblockunsecurequeryfiles should be REG_DWORD = 1

  If the value for enableblockunsecurequeryfiles is Reg_DWORD = 1, this is not a finding.


vuln_id: V-223339
rule_id: SV-223339r961086_rule
severity: CAT II
title: Untrusted database files must be opened in Excel in Protected View mode.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether database files (.dbf) opened from an untrusted location are always opened in Protected View.

  If you enable this policy setting, database files opened from an untrusted location are always opened in Protected View. Users will not be able to change this setting under File >> Options >> Trust Center >> Trust Center Settings >> Protected View.

  If you disable or do not configure this policy setting, database files opened from an untrusted location are not opened in Protected View, unless users have changed this setting in the Trust Center.

  Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Always open untrusted database files in Protected View to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Always open untrusted database files in Protected View is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security\protectedview

  If the value for enabledatabasefileprotectedview is REG_DWORD = 1, this is not a finding.


vuln_id: V-223340
rule_id: SV-223340r961086_rule
severity: CAT II
title: Files from Internet zone must be opened in Excel in Protected View mode.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

  If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

  If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security\protectedview

  If the value DisableInternetFilesInPV is REG_DWORD = 0, this is not a finding. 

  If the value does not exist, this is not a finding.

  If the value is REG_DWORD = 1, this is a finding.


vuln_id: V-223341
rule_id: SV-223341r961092_rule
severity: CAT II
title: Files from unsafe locations must be opened in Excel in Protected View mode.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting lets you determine if files located in unsafe locations will open in Protected View. If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

  If you enable this policy setting, files located in unsafe locations do not open in Protected View.

  If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security\protectedview

  If the value DisableUnsafeLocationsInPV is REG_DWORD = 0, this is not a finding.

  If the value does not exist, this is not a finding.

  If the value is REG_DWORD = 1, this is a finding.


vuln_id: V-223342
rule_id: SV-223342r961092_rule
severity: CAT II
title: Files failing file validation must be opened in Excel in Protected view mode and disallow edits.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how Office handles documents when they fail file validation. 

  If you enable this policy setting, you can configure the following options for files that fail file validation:
  - Block files completely. Users cannot open the files.
  - Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting.
  - Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting.

  If you disable this policy setting, Office follows the "Open files in Protected View and disallow edit" behavior.

  If you do not configure this policy setting, Office follows the "Open files in Protected View and allow edit" behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails to "Enabled: Open in Protected View". 

  Uncheck the "Allow edit" check box.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails is set to "Enabled: Open in Protected View". Verify the check box for "Allow edit" is not selected.

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\Excel\security\filevalidation

  If the value openinprotectedview does not exist, this is not a finding. 

  If both the value for openinprotectedview is REG_DWORD = 1 and the value for DisableEditFromPV is set to REG_DWORD = 1, this is not a finding.


vuln_id: V-223343
rule_id: SV-223343r961092_rule
severity: CAT II
title: File attachments from Outlook must be opened in Excel in Protected mode.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine if Excel files in Outlook attachments open in Protected View.

  If you enable this policy setting, Outlook attachments do not open in Protected View.

  If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Turn off Protected View for attachments opened from Outlook to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Turn off Protected View for attachments opened from Outlook is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\excel\security\protectedview

  If the value DisableAttachmentsInPV is REG_DWORD = 0, this is not a finding.


vuln_id: V-223344
rule_id: SV-223344r1043178_rule
severity: CAT II
title: The SIP security mode in Lync must be enabled.
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>When Lync connects to the server, it supports various authentication mechanisms. This policy allows the user to specify whether Digest and Basic authentication are supported. Disabled (default): NTLM/Kerberos/TLS-DSK/Digest/Basic Enabled: Authentication mechanisms: NTLM/Kerberos/TLS-DSK Gal Download: Requires HTTPS if user is not logged in as an internal user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Configure SIP security mode" to "Enabled".

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Configure SIP security mode" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKLM\Software\Policies\Microsoft\office\16.0\lync

  If the value enablesiphighsecuritymode is REG_DWORD = 1, this is not a finding.


vuln_id: V-223345
rule_id: SV-223345r1043178_rule
severity: CAT II
title: The HTTP fallback for SIP connection in Lync must be disabled.
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>Prevents from HTTP being used for SIP connection in case TLS or TCP fail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Disable HTTP fallback for SIP connection" to "Enabled".

check_text:
  Verify the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Disable HTTP fallback for SIP connection" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKLM\Software\Policies\Microsoft\office\16.0\lync

  If the value disablehttpconnect is REG_DWORD = 1, this is not a finding.


vuln_id: V-223346
rule_id: SV-223346r961878_rule
severity: CAT II
cci: CCI-001967
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  The Exchange client authentication with Exchange servers must be enabled to use Kerberos Password Authentication.

description:
  <VulnDiscussion>This policy setting controls which authentication method Outlook uses to authenticate with Microsoft Exchange Server. Note: Exchange Server supports the Kerberos authentication protocol and NTLM for authentication. The Kerberos protocol is the more secure authentication method and is supported on Windows 2000 Server and later versions. NTLM authentication is supported in pre-Windows 2000 environments.

  If you enable this policy setting, you can choose from three different options for controlling how Outlook authenticates with Microsoft Exchange Server:

  - Kerberos/NTLM password authentication. Outlook attempts to authenticate using the Kerberos authentication protocol. If this attempt fails, Outlook attempts to authenticate using NTLM. This option is the default configuration.
  - Kerberos password authentication. Outlook attempts to authenticate using the Kerberos protocol only.
  - NTLM password authentication. Outlook attempts to authenticate using NTLM only.

  If you disable or do not configure this policy setting, Outlook will attempt to authenticate using the Kerberos authentication protocol. If it cannot (because no Windows 2000 or later domain controllers are available), it will authenticate using NTLM.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Authentication with Exchange Server to Kerberos Password Authentication.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Authentication with Exchange Server is set to Kerberos Password Authentication.
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value authenticationservice is set to REG_DWORD = 16 (decimal) or 10 (hex), this is not a finding.


vuln_id: V-223347
rule_id: SV-223347r961878_rule
severity: CAT II
cci: CCI-001967
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Outlook must use remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers.

description:
  <VulnDiscussion>This policy setting controls whether Outlook uses remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers. 

  If you enable this policy setting, Outlook uses RPC encryption when communicating with an Exchange server. Note: RPC encryption only encrypts the data from the Outlook client computer to the Exchange server. It does not encrypt the messages themselves as they traverse the Internet. 

  If you disable or do not configure this policy setting, RPC encryption is still used by default. This setting allows you to override the corresponding per-profile setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Enable RPC encryption to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Enable RPC encryption is set to "Enabled".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\rpc

  If the value for enablerpcencryption is set to REG_DWORD = 1, this is not a finding.


vuln_id: V-223348
rule_id: SV-223348r961092_rule
severity: CAT II
title: Scripts associated with public folders must be prevented from execution in Outlook.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for public folders.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for public folders to "Enabled".

check_text:
  Verify the policy for Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for public folders is set to "Enabled".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for publicfolderscript is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223349
rule_id: SV-223349r961092_rule
severity: CAT II
title: Scripts associated with shared folders must be prevented from execution in Outlook.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Outlook executes scripts associated with custom forms or folder home pages for shared folders.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for shared folders to "Enabled".

check_text:
  Verify the policy for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for shared folders is set to "Enabled".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for sharedfolderscript is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223350
rule_id: SV-223350r961863_rule
severity: CAT II
title: Files dragged from an Outlook e-mail to the file system must be created in ANSI format.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether e-mail messages dragged from Outlook to the file system are saved in Unicode or ANSI format.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Use Unicode format when dragging e-mail message to file system to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Use Unicode format when dragging e-mail message to file system is set to "Disabled".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\options\general

  If the value for msgformat is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223351
rule_id: SV-223351r961863_rule
severity: CAT II
title: The junk email protection level must be set to No Automatic Filtering.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls the Junk E-mail protection level. The Junk E-mail Filter in Outlook helps to prevent junk email messages, also known as spam, from cluttering a user's Inbox. The filter evaluates each incoming message based on several factors, including the time when the message was sent and the content of the message. The filter does not single out any particular sender or message type, but instead analyzes each message based on its content and structure to determine if it is likely spam.

  A Junk E-mail filtering option of "No Automatic Filtering" will evaluate emails against domain names and email addresses in the blocked sender list and send them to the Junk E-mail folder. 

  A Junk E-mail filtering option of "High" is not recommended when behind enterprise-level capabilities such as Enterprise Email Security Gateway (EEMSG), Cloud-Based Internet Isolation (CBII), and O365 Exchange Online Protection (EOP).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options.

  Set the Junk E-mail protection level to "No Automatic Filtering".

check_text:
  Note: If the Outlook client application is not used to access Office 365 email (i.e., email is only accessed via Outlook Web Access [OWA]), this check is not applicable.  

  Verify Outlook Junk E-mail protection is set to "No Automatic Filtering".

  In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options.

  Verify Junk E-mail protection is set to "No Automatic Filtering".
   
  If the system being inspected is not behind EEMSG, CBII, or O365 EOP, the Junk E-mail protection level must be set to "High".

  If Junk E-mail protection is not set to "No Automatic Filtering", this is a finding.

  If the system is not behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP and the Junk E-mail protection is not set to "High", this is a  finding.


vuln_id: V-223352
rule_id: SV-223352r961092_rule
severity: CAT II
title: Active X One-Off forms must only be enabled to load with Outlook Controls.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>By default, third-party ActiveX controls are not allowed to run in one-off forms in Outlook. You can change this behavior so that Safe Controls (Microsoft Forms 2.0 controls and the Outlook Recipient and Body controls) are allowed in one-off forms, or so that all ActiveX controls are allowed to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Allow Active X One Off Forms to "Enabled" "Load only Outlook Controls".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Allow Active X One Off Forms is set to "Enabled" "Load only Outlook Controls".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for allowactivexoneoffforms is REG_DWORD = 0, this is not a finding.


vuln_id: V-223353
rule_id: SV-223353r961353_rule
severity: CAT II
title: Outlook must be configured to prevent users overriding attachment security settings.
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting prevents users from overriding the set of attachments blocked by Outlook.

  If you enable this policy setting users will be prevented from overriding the set of attachments blocked by Outlook. Outlook also checks the "Level1Remove" registry key when this setting is specified. 

  If you disable or do not configure this policy setting, users will be allowed to override the set of attachments blocked by Outlook.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Prevent users from customizing attachment security settings to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Prevent users from customizing attachment security settings is set to "Enabled".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook

  If the value for disallowattachmentcustomization is set to REG_DWORD = 1, this is not a finding.


vuln_id: V-223354
rule_id: SV-223354r961863_rule
severity: CAT II
title: Internet must not be included in Safe Zone for picture download in Outlook.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the Internet are downloaded without Outlook users explicitly choosing to do so. 

  If you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the Internet and users will not be able to change the setting. 

  If you disable or do not configure this policy setting, Outlook does not consider the Internet a safe zone, which means that Outlook will not automatically download content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Automatic Picture Download Settings >> Include Internet in Safe Zones for Automatic Picture Download to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Automatic Picture Download Settings >> Include Internet in Safe Zones for Automatic Picture Download is set to "Disabled".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\options\mail

  If the value for Internet is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223355
rule_id: SV-223355r961863_rule
severity: CAT II
title: The Publish to Global Address List (GAL) button must be disabled in Outlook.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Outlook users can publish e-mail certificates to the Global Address List (GAL). 

  If you enable this policy setting, the "Publish to GAL" button does not display in the "E-mail Security" section of the Trust Center. 

  If you disable or do not configure this policy setting, Outlook users can publish their e-mail certificates to the GAL through the "E-mail Security" section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Do not display 'Publish to GAL' button to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Do not display 'Publish to GAL' button is set to "Enabled".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for publishtogaldisabled is REG_DWORD = 1, this is not a finding.


vuln_id: V-223356
rule_id: SV-223356r1117184_rule
severity: CAT II
title: The minimum encryption key length in Outlook must be at least 168.
cci: CCI-002450
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to set the minimum key length for an encrypted e-mail message.

  If you enable this policy setting, you may set the minimum key length for an encrypted e-mail message. Outlook will display a warning dialog if the user tries to send a message using an encryption key that is below the minimum encryption key value set. The user can still choose to ignore the warning and send using the encryption key originally chosen.

  If you disable or do not configure this policy setting, a dialog warning will be shown to the user if the user attempts to send a message using encryption. The user can still choose to ignore the warning and send using the encryption key originally chosen.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Minimum encryption settings to "Enabled"and a Minimum key size (in bits) of "168" or above.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Minimum encryption settings is set to "Enabled" and a Minimum key size (in bits) of "168" or above.

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for minenckey is set to 168 or above, this is not a finding.


vuln_id: V-223357
rule_id: SV-223357r961086_rule
severity: CAT II
title: The warning about invalid digital signatures must be enabled to warn Outlook users.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how Outlook warns users about messages with invalid digital signatures.

  If you enable this policy setting, you can choose from three options for controlling how Outlook users are warned about invalid signatures:
  - Let user decide if they want to be warned. This option enforces the default configuration.
  - Always warn about invalid signatures.
  - Never warn about invalid signatures.

  If you disable or do not configure this policy setting, if users open e-mail messages that include invalid digital signatures, Outlook displays a warning dialog. Users can decide whether they want to be warned about invalid signatures in the future.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Warning to "Enabled" "Always warn about invalid signatures".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Warning is set to "Enabled" "Always warn about invalid signatures".

  Use the Windows Registry to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for warnaboutinvalid is set to REG_DWORD = 1, this is not a finding.


vuln_id: V-223358
rule_id: SV-223358r961893_rule
severity: CAT II
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Outlook must be configured to allow retrieving of Certificate Revocation Lists (CRLs) always when online.

description:
  <VulnDiscussion>This policy setting controls how Outlook retrieves Certificate Revocation Lists to verify the validity of certificates. Certificate revocation lists (CRLs) are lists of digital certificates that have been revoked by their controlling certificate authorities (CAs), typically because the certificates were issued improperly or their associated private keys were compromised. 

  If you enable this policy setting, you can choose from three options to govern how Outlook uses CRLs: 
  - Use system Default. Outlook relies on the CRL download schedule that is configured for the operating system. 
  - When online always retrieve the CRL. This option is the default configuration in Outlook. 
  - Never retrieve the CRL. Outlook will not attempt to download the CRL for a certificate, even if it is online. This option can reduce security. 

  If you disable or do not configure this policy setting, when Outlook handles a certificate that includes a URL from which a CRL can be downloaded, Outlook will retrieve the CRL from the provided URL if Outlook is online.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Status dialog box >> Retrieving CRLs (Certificate Revocation Lists) to "Enabled" "When online always retrieve the CRL".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Status dialog box >> Retrieving CRLs (Certificate Revocation Lists) is set to "Enabled" "When online always retrieve the CRL".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for usecrlchasing is set to REG_DWORD = 1, this is not a finding.


vuln_id: V-223359
rule_id: SV-223359r961863_rule
severity: CAT II
title: The Outlook Security Mode must be enabled to always use the Outlook Security Group Policy.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls which set of security settings are enforced in Outlook. If you enable this policy setting, you can choose from four options for enforcing Outlook security settings: 
   
  - Outlook Default Security - This option is the default configuration in Outlook. Users can configure security themselves, and Outlook ignores any security-related settings configured in Group Policy. 
  - Use Security Form from "Outlook Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. 
  - Use Security Form from "Outlook 10 Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. 
  - Use Outlook Security Group Policy - Outlook uses security settings from Group Policy. Important: You must enable this policy setting if you want to apply the other Outlook security policy settings mentioned in this guide. If you disable or do not configure this policy setting, Outlook users can configure security for themselves, and Outlook ignores any security-related settings that are configured in Group Policy. 

  Note: In previous versions of Outlook, when security settings were published in a form in Exchange Server public folders, users who needed these settings required the HKEY_CURRENT_USER >> Software >> Policies >> Microsoft >> Security >> CheckAdminSettings registry key to be set on their computers for the settings to apply. In Outlook, the CheckAdminSettings registry key is no longer used to determine users' security settings. Instead, the Outlook Security Mode setting can be used to determine whether Outlook security should be controlled directly by Group Policy, by the security form from the Outlook Security Settings Public Folder, or by the settings on users' own computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Outlook Security Mode to "Enabled (Use Outlook Security Group Policy)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Outlook Security Mode is set to "Enabled (Use Outlook Security Group Policy)".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for adminsecuritymode is set to REG_DWORD = 3, this is not a finding.


vuln_id: V-223360
rule_id: SV-223360r961086_rule
severity: CAT II
title: The ability to demote attachments from Level 2 to Level 1 must be disabled.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Outlook users can demote attachments to Level 2 by using a registry key, which will allow them to save files to disk and open them from that location. Outlook uses two levels of security to restrict access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. 

  If you enable this policy setting, users can create a list of Level 1 file types to demote to Level 2 by adding the file types to the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security\Level1Remove. 

  If you disable or do not configure this policy setting, users cannot demote level 1 attachments to level 2, and the HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security\Level1Remove registry key has no effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Allow users to demote attachments to Level 2 to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Allow users to demote attachments to Level 2 is set to "Disabled".
   
  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value allowuserstolowerattachments is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223361
rule_id: SV-223361r961086_rule
severity: CAT II
title: The display of Level 1 attachments must be disabled in Outlook.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Outlook blocks potentially dangerous attachments designated Level 1. Outlook uses two levels of security to restrict users' access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. 

  If you enable this policy setting, Outlook users can gain access to Level 1 file type attachments by first saving the attachments to disk and then opening them, as with Level 2 attachments. If you disable this policy setting, Level 1 attachments do not display under any circumstances. If you do not configure this policy setting, Outlook completely blocks access to Level 1 files, and requires users to save Level 2 files to disk before opening them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security "Display Level 1 attachments" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Display Level 1 attachments is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\outlook\security

  If the value ShowLevel1Attach is REG_DWORD = 0, this is not a finding.


vuln_id: V-223362
rule_id: SV-223362r961086_rule
severity: CAT II
title: Level 1 file attachments must be blocked from being delivered.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether Outlook users can demote attachments to Level 2 by using a registry key, which will allow them to save files to disk and open them from that location. Outlook uses two levels of security to restrict access to files attached to email messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. 

  If you enable this policy setting, users can create a list of Level 1 file types to demote to Level 2 by adding the file types to the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level1Remove. 

  If this policy setting is disabled or not configured, users cannot demote Level 1 attachments to Level 2, and the HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level1Remove registry key has no effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 1 to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 1 is set to "Disabled".
   
  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\outlook\security\FileExtensionsRemoveLevel1

  If the registry key exists, this is a finding.


vuln_id: V-223363
rule_id: SV-223363r961086_rule
severity: CAT II
title: Level 2 file attachments must be blocked from being delivered.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls which types of attachments (determined by file extension) must be saved to disk before users can open them. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. 

  If you enable this policy setting, you can specify a list of attachment file types to classify as Level 2, which forces users to actively decide to download the attachment to view it. 

  If you disable or do not configure this policy setting, Outlook does not classify any file type extensions as Level 2. 

  Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2016\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 2 to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 2 is set to "Disabled".
   
  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\outlook\security\FileExtensionsRemoveLevel2

  If the registry key exists, this is a finding.


vuln_id: V-223364
rule_id: SV-223364r961092_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Outlook must be configured to not run scripts in forms in which the script and the layout are contained within the message.

description:
  <VulnDiscussion>This policy setting controls whether scripts can run in Outlook forms in which the script and layout are contained within the message. If you enable this policy setting, scripts can run in one-off Outlook forms. If you disable or do not configure this policy setting, Outlook does not run scripts in forms in which the script and the layout are contained within the message. Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2016\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Security "Allow scripts in one-off Outlook forms" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Security "Allow scripts in one-off Outlook forms" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\outlook\security

  If the value EnableOneOffFormScripts is REG_DWORD = 0, this is not a finding.


vuln_id: V-223365
rule_id: SV-223365r961779_rule
severity: CAT II
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  When a custom action is executed that uses the Outlook object model, Outlook must automatically deny it.

description:
  <VulnDiscussion>This policy setting controls whether Outlook prompts users before executing a custom action. Custom actions add functionality to Outlook that can be triggered as part of a rule. Among other possible features, custom actions can be created that reply to messages in ways that circumvent the Outlook model's programmatic send protections. If this policy is enabled, four options are available to control how Outlook functions when a custom action is executed that uses the Outlook object model: 
  - Prompt User
  - Automatically Approve
  - Automatically Deny 
  - Prompt user based on computer security. This option enforces the default configuration in Outlook. 

  If this policy is disabled or not configured, when Outlook or another program initiates a custom action using the Outlook object model, users are prompted to allow or reject the action. If this configuration is changed, malicious code can use the Outlook object model to compromise sensitive information or otherwise cause data and computing resources to be at risk. This is the equivalent of choosing Enabled -- Prompt user based on computer security.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Setting >> Set Outlook object model custom actions execution prompt to "Enabled" and select "Automatically Deny".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Security >> Set Outlook object model custom actions execution prompt is set to "Enabled" and "Automatically Deny".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for "promptoomcustomaction" is set to "REG_DWORD = 0", this is not a finding.


vuln_id: V-223366
rule_id: SV-223366r961779_rule
severity: CAT II
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  When an untrusted program attempts to programmatically access an Address Book using the Outlook object model, Outlook must automatically deny it.

description:
  <VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to gain access to an Address Book using the Outlook object model. 

  If you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically access an Address Book using the Outlook object model:
  - Prompt user - Users are prompted to approve every access attempt. 
  - Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. 
  - Automatically deny - Outlook will automatically deny programmatic access requests from any program.
  - Prompt user based on computer security - Outlook will rely on the setting in the ''Programmatic Access'' section of the Trust Center. This is the default behavior.

  If you disable or do not configure this policy setting, when an untrusted application attempts to access the address book programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when accessing an address book to "Enabled (Automatically Deny)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when accessing an address book is set to "Enabled (Automatically Deny)".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for promptoomaddressbookaccess is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223367
rule_id: SV-223367r961779_rule
severity: CAT II
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  When a user designs a custom form in Outlook and attempts to bind an Address Information field to a combination or formula custom field, Outlook must automatically deny it.

description:
  <VulnDiscussion>This policy setting controls what happens when a user designs a custom form in Outlook and attempts to bind an Address Information field to a combination or formula custom field. If you enable this policy setting, you can choose from four different options when an untrusted program attempts to access address information using the UserProperties. Find method of the Outlook object model: 

  - Prompt user. The user will be prompted to approve every access attempt. - Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. 
  - Automatically deny. Outlook will automatically deny programmatic access requests from any program. 
  - Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. 

  If you disable or do not configure this policy setting, when a user tries to bind an address information field to a combination or formula custom field in a custom form, Outlook relies on the setting configured in the "Programmatic Access" section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt When accessing the Formula property of a UserProperty object to "Enabled (Automatically Deny)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when accessing the Formula property of a UserProperty object is set to "Enabled (Automatically Deny)".

  Use the Windows Registry to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\outlook\security

  If the value PromptOOMFormulaAccess is REG_DWORD = 0, this is not a finding.


vuln_id: V-223368
rule_id: SV-223368r961779_rule
severity: CAT II
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  When an untrusted program attempts to use the Save As command to programmatically save an item, Outlook must automatically deny it.

description:
  <VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to use the Save As command to programmatically save an item. 

  If you enable this policy setting, you can choose from four different options when an untrusted program attempts to use the Save As command to programmatically save an item:
  - Prompt user. The user will be prompted to approve every access attempt. 
  - Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. 
  - Automatically deny. Outlook will automatically deny programmatic access requests from any program.
  - Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration.

  If you disable or do not configure this policy setting, when an untrusted application attempts to use the Save As command, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when executing Save As to "Enabled (Automatically Deny)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when executing Save As is set to "Enabled (Automatically Deny)".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for promptoomsaveas is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223369
rule_id: SV-223369r961779_rule
severity: CAT II
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  When an untrusted program attempts to gain access to a recipient field, such as the, To: field, using the Outlook object model, Outlook must automatically deny it.

description:
  <VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to gain access to a recipient field, such as the ''To:'' field, using the Outlook object model.

  If you enable this policy setting, you can choose from four different options when an untrusted program attempts to access a recipient field using the Outlook object model:
  - Prompt user. The user will be prompted to approve every access attempt.
  - Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended.
  - Automatically deny. Outlook will automatically deny programmatic access requests from any program.
  - Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration.

  If you disable or do not configure this policy setting, when an untrusted application attempts to access recipient fields, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when reading address information to "Enabled (Automatically Deny)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when reading address information is set to "Enabled (Automatically Deny)".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for promptoomaddressinformationaccess is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223370
rule_id: SV-223370r961779_rule
severity: CAT II
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  When an untrusted program attempts to programmatically send e-mail in Outlook using the Response method of a task or meeting request, Outlook must automatically deny it.

description:
  <VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to programmatically send e-mail in Outlook using the Response method of a task or meeting request. 

  If you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically send e-mail using the Response method of a task or meeting request:
  - Prompt user. The user will be prompted to approve every access attempt.
  - Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended.
  - Automatically deny. Outlook will automatically deny programmatic access requests from any program. 
  - Prompt user based on computer security. Outlook only prompts users when antivirus software is out of date or not running. This is the default configuration. 

  If you disable or do not configure this policy setting, when an untrusted application attempts to respond to tasks or meeting requests programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when responding to meeting and task requests to "Enabled (Automatically Deny)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when responding to meeting and task requests is set to "Enabled (Automatically Deny)"

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for promptoommeetingtaskrequestresponse is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223371
rule_id: SV-223371r961779_rule
severity: CAT II
cci: CCI-002460
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  When an untrusted program attempts to send e-mail programmatically using the Outlook object model, Outlook must automatically deny it.

description:
  <VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to send e-mail programmatically using the Outlook object model. 

  If you enable this policy setting, you can choose from four different options when an untrusted program attempts to send e-mail programmatically using the Outlook object model: 
  - Prompt user - The user will be prompted to approve every access attempt.
  - Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. 
  - Automatically deny - Outlook will automatically deny programmatic access requests from any program. 
  - Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. 

  Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2016\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy".

  If you disable or do not configure this policy setting, when an untrusted application attempts to send mail programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when sending mail to "Enabled (Automatically Deny)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when sending mail is set to "Enabled (Automatically Deny)".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for promptoomsend is set to REG_DWORD = 0, this is not a finding.


vuln_id: V-223372
rule_id: SV-223372r961863_rule
severity: CAT II
title: Outlook must be configured to not allow hyperlinks in suspected phishing messages.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether hyperlinks in suspected phishing e-mail messages in Outlook are allowed. If you enable this policy setting, Outlook will allow hyperlinks in suspected phishing messages that are not also classified as junk e-mail. If you disable or do not configure this policy setting, Outlook will not allow hyperlinks in suspected phishing messages, even if they are not classified as junk e-mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center "Allow hyperlinks in suspected phishing e-mail messages" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center "Allow hyperlinks in suspected phishing e-mail messages" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\outlook\options\mail

  If the value JunkMailEnableLinks is REG_DWORD = 0, this is not a finding.


vuln_id: V-223373
rule_id: SV-223373r961086_rule
severity: CAT II
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  The Security Level for macros in Outlook must be configured to Warn for signed and disable unsigned.

description:
  <VulnDiscussion>This policy setting controls the security level for macros in Outlook. 

  If you enable this policy setting, you can choose from four options for handling macros in Outlook: 
  - Always warn. This option corresponds to the "Warnings for all macros" option in the "Macro Security" section of the Outlook Trust Center. Outlook disables all macros that are not opened from a trusted location, even if the macros are signed by a trusted publisher. For each disabled macro, Outlook displays a security alert dialog box with information about the macro and its digital signature (if present), and allows users to enable the macro or leave it disabled. 
  - Never warn, disable all. This option corresponds to the "No warnings and disable all macros" option in the Trust Center. Outlook disables all macros that are not opened from trusted locations, and does not notify users. 
  - Warning for signed, disable unsigned. This option corresponds to the "Warnings for signed macros; all unsigned macros are disabled" option in the Trust Center. Outlook handles macros as follows: 
  --If a macro is digitally signed by a trusted publisher, the macro can run if the user has already trusted the publisher. 
  --If a macro has a valid signature from a publisher that the user has not trusted, the security alert dialog box for the macro lets the user choose whether to enable the macro for the current session, disable the macro for the current session, or to add the publisher to the Trusted Publishers list so that it will run without prompting the user in the future. 
  --If a macro does not have a valid signature, Outlook disables it without prompting the user, unless it is opened from a trusted location. 
  This option is the default configuration in Outlook. 
  - No security check. This option corresponds to the "No security check for macros (Not recommended)" option in the Trust Center. Outlook runs all macros without prompting users. This configuration makes users' computers vulnerable to potentially malicious code and is not recommended. 

  If you disable or do not configure this policy setting, the behavior is the equivalent of Enabled -- Warning for signed, disable unsigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center >> Security setting for macros must to "Enabled: Warn for signed, disable unsigned".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center >> Security setting for macros must be set to "Enabled: Warn for signed, disable unsigned".

  Use the Windows Registry to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\outlook\security

  If the value for level is set to REG_DWORD = 3, this is not a finding.


vuln_id: V-223374
rule_id: SV-223374r961092_rule
severity: CAT II
title: Trusted Locations on the network must be disabled in Project.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether trusted locations on the network can be used.

  If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

  If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

  If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

  Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting as the "Allow Trusted Locations on my network (not recommended)" check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

  If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> Allow Trusted Locations on the network to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> Allow Trusted Locations on the network is set to "Disabled".
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\ms project\security\trusted locations

  If the value allownetworklocations is REG_DWORD = 0, this is not a finding.


vuln_id: V-223375
rule_id: SV-223375r1016169_rule
severity: CAT II
title: Project must automatically disable unsigned add-ins without informing users.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if the "Require that application add-ins are signed by Trusted Publisher" policy setting is enabled, which prevents users from changing this policy setting. 

  If this policy setting is enabled, applications automatically disable unsigned add-ins without informing users. 

  If this policy setting is disabled, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. 

  If this policy setting is not configured, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> "Disable Trust Bar Notification for unsigned application add-ins and block them" to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\Microsoft\office\16.0\ms project\security

  If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.


vuln_id: V-223376
rule_id: SV-223376r960963_rule
severity: CAT II
title: VBA Macros not digitally signed must be blocked in Project.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

  If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:

  - Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. This option also allows users to potentially enable unsigned/untrusted macros.  If a site requires the use of macros, they must be signed /approved and added to appropriate locations listed in the Trust Center Settings. 
  - Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
  - Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
  - Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.

  If you disable this policy setting, "Disable all with notification" will be the default setting.

  If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document.

  Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> VBA Macro Notification Settings to "Enabled" "Disable all except digitally signed macros".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Enabled" "Disable all except digitally signed macros".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\ms project\security

  If the value for vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD =  4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.


vuln_id: V-223377
rule_id: SV-223377r960963_rule
severity: CAT II
title: VBA Macros not digitally signed must be blocked in PowerPoint.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

  If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:

  - Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. This option also allows users to potentially enable unsigned/untrusted macros.  If a site requires the use of macros, they must be signed /approved and added to appropriate locations listed in the Trust Center Settings. 
  - Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
  - Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
  - Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.

  If you disable this policy setting, "Disable all with notification" will be the default setting.

  If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document.

  Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> VBA Macro Notification Settings to "Enabled" "Disable all except digitally signed macros".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Enabled" "Disable all except digitally signed macros".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\powerpoint\security

  If the value for vbawarnings is REG_DWORD = 3 this is not a finding. A value of REG_DWORD =  4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.


vuln_id: V-223378
rule_id: SV-223378r961092_rule
severity: CAT II
title: The ability to run programs from PowerPoint must be disabled.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls the prompting and activation behavior for the "Run Programs" option for action buttons in PowerPoint.

  If you enable this policy setting, you can choose from three options to control how the "Run Programs" option functions:
  - Disable (do not run any programs). If users click an action button with the "Run Programs" action assigned to it, nothing will happen. This option enforces the default configuration in PowerPoint.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Run Programs to "Enabled" "Disable (do not run any programs)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Run Programs is set to "Enabled" "Disable (do not run any programs)".
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\powerpoint\security

  If the value runprograms does not exist, this is not a finding. If the value is REG_DWORD = 0, this is not a finding.


vuln_id: V-223379
rule_id: SV-223379r961086_rule
severity: CAT II
title: Open/Save of PowerPoint 97-2003 presentations, shows, templates, and add-in files must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting.

  If you enable this policy setting, you can specify whether users can open, view, edit, or save files.

  The options that can be selected are below. Note: Not all options may be available for this policy setting.
  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings >> PowerPoint 97-2003 presentations, shows, templates and add-in files to "Enabled" "Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings >> PowerPoint 97-2003 presentations, shows, templates and add-in files is set to "Enabled" "Open/Save blocked, use open policy".
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\powerpoint\security\fileblock

  If the value for binaryfiles is set to REG_DWORD = 2, this is not a finding.


vuln_id: V-223380
rule_id: SV-223380r961086_rule
severity: CAT II
title: The default file block behavior must be set to not open blocked files in PowerPoint.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine if users can open, view, or edit Word files. If you enable this policy setting, you can set one of these options:
  - Blocked files are not opened.
  - Blocked files open in Protected View and cannot be edited.
  - Blocked files open in Protected View and can be edited. 

  If you disable or do not configure this policy setting, the behavior is the same as the "Blocked files are not opened" setting. Users will not be able to open blocked files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" to "Enabled: Blocked files are not opened".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" is set to "Enabled: Blocked files are not opened".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\fileblock

  If the value OpenInProtectedView is REG_DWORD = 0, this is not a finding.


vuln_id: V-223381
rule_id: SV-223381r961092_rule
severity: CAT II
title: Encrypted macros in PowerPoint Open XML presentations must be scanned.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether encrypted macros in Open XML presentations are required to be scanned with anti-virus software before being opened. If you enable this policy setting, you may choose one of these options:

  - Scan encrypted macros: Encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted presentation that contains macros.
  - Scan if anti-virus software available: If anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load.
  - Load macros without scanning: Do not check for anti-virus software and allow macros to be loaded in an encrypted file. If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Scan encrypted macros in PowerPoint Open XML presentations" to "Enabled" and "Scan encrypted macros".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Scan encrypted macros in PowerPoint Open XML presentations" is set to "Enabled" and "Scan encrypted macros".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security

  If the value PowerPointBypassEncryptedMacroScan does not exist, this is not a finding.

  If the value is REG_DWORD = 0, this is not a finding.


vuln_id: V-223382
rule_id: SV-223382r961092_rule
severity: CAT II
title: File validation in PowerPoint must be enabled.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to turn off the file validation feature. If you enable this policy setting, file validation will be turned off. If you disable or do not configure this policy setting, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform against the file format schema before they are opened.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Turn off file validation" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Turn off file validation" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\filevalidation

  If the value EnableOnLoad is REG_DWORD = 1, this is not a finding.


vuln_id: V-223383
rule_id: SV-223383r961092_rule
severity: CAT II
title: Macros from the Internet must be blocked from running in PowerPoint.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet. If you enable this policy setting, macros are blocked from running, even if "Enable all macros" is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to "Enable Content", users will receive a notification that macros are blocked from running. 

  If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run. If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\powerpoint\security

  If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.


vuln_id: V-223384
rule_id: SV-223384r1016170_rule
severity: CAT II
title: Unsigned add-ins in PowerPoint must be blocked with no Trust Bar Notification to the user.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if the "Require that application add-ins are signed by Trusted Publisher" policy setting is enabled, which prevents users from changing this policy setting. 

  If this policy setting is enabled, applications automatically disable unsigned add-ins without informing users. 

  If this policy setting is disabled, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. 

  If this policy setting is not configured, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\Microsoft\office\16.0\powerpoint\security

  If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.


vuln_id: V-223385
rule_id: SV-223385r961086_rule
severity: CAT II
title: Files downloaded from the Internet must be opened in Protected view in PowerPoint.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View. If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View. If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files from the Internet zone in Protected View" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files from the Internet zone in Protected View" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\protectedview

  If the value DisableInternetFilesInPV is REG_DWORD = 0, this is not a finding.


vuln_id: V-223386
rule_id: SV-223386r961086_rule
severity: CAT II
title: PowerPoint attachments opened from Outlook must be in Protected View.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows for determining whether PowerPoint files in Outlook attachments open in Protected View. If enabling this policy setting, Outlook attachments do not open in Protected View. If disabling or not configuring this policy setting, Outlook attachments open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Turn off Protected View for attachments opened from Outlook" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Turn off Protected View for attachments opened from Outlook" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\protectedview

  If the value DisableAttachmentsInPV is REG_DWORD = 0, this is not a finding.


vuln_id: V-223387
rule_id: SV-223387r961086_rule
severity: CAT II
title: Files in unsafe locations must be opened in Protected view in PowerPoint.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting determines whether files located in unsafe locations will open in Protected View. If unsafe locations have not been specified, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations. If enabling this policy setting, files located in unsafe locations do not open in Protected View. If disabling or not configuring this policy setting, files located in unsafe locations open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files in unsafe locations in Protected View" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files in unsafe locations in Protected View" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\protectedview

  If the value DisableUnsafeLocationsInPV is REG_DWORD = 0, this is not a finding.


vuln_id: V-223388
rule_id: SV-223388r961092_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  If file validation fails, files must be opened in Protected view in PowerPoint with ability to edit disabled.

description:
  <VulnDiscussion>This policy setting controls how Office handles documents when they fail file validation. If you enable this policy setting, you can configure the following options for files that fail file validation:

  - Block files completely. Users cannot open the files.
  - Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting.
  - Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting.

  If you disable this policy setting, Office follows the "Open files in Protected View and disallow edit" behavior. If you do not configure this policy setting, Office follows the "Open files in Protected View and allow edit" behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails to "Enabled: Open in Protected View". 

  Uncheck the "Allow edit" check box.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails is set to "Enabled: Open in Protected View". Verify the check box for "Allow edit" is not selected.

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\filevalidation

  If the value openinprotectedview does not exist, this is not a finding. 

  If both the value for openinprotectedview is REG_DWORD = 1 and the value for DisableEditFromPV is set to REG_DWORD = 1, this is not a finding.


vuln_id: V-223389
rule_id: SV-223389r961092_rule
severity: CAT II
title: The use of network locations must be ignored in PowerPoint.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. 

  If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers. 

  Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. It is recommended that you do not enable this policy setting, as the "Allow Trusted Locations on my network (not recommended) check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users. If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\trusted locations

  If the value AllowNetworkLocations is REG_DWORD = 0, this is not a finding.


vuln_id: V-223390
rule_id: SV-223390r961086_rule
severity: CAT II
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  Publisher must be configured to prompt the user when another application programmatically opens a macro.

description:
  <VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting.

  If you enable this policy setting, applications automatically disable unsigned add-ins without informing users.
   
  If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.

  If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Publisher Automation Security Level to "Enabled" "By UI (prompted)"

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Publisher Automation Security Level is set to "Enabled" "By UI (prompted)".
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\common\security

  If the value automationsecuritypublisher is REG_DWORD = 2, this is not a finding.


vuln_id: V-223391
rule_id: SV-223391r1016171_rule
severity: CAT II
title: Publisher must automatically disable unsigned add-ins without informing users.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if the "Require that application add-ins are signed by Trusted Publisher" policy setting is enabled, which prevents users from changing this policy setting.

  If this policy setting is enabled, applications automatically disable unsigned add-ins without informing users.
   
  If this policy setting is disabled, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.

  If this policy setting is not configured, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\publisher\security

  If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.


vuln_id: V-223392
rule_id: SV-223392r1016172_rule
severity: CAT II
title: Publisher must disable all unsigned VBA macros.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

  If this policy setting is enabled, users can choose from four options for determining how the specified applications will warn the user about macros:
   
  - Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. This option also allows users to potentially enable unsigned/untrusted macros. If a site requires the use of macros, they must be signed/approved and added to appropriate locations listed in the Trust Center Settings. 
  - Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
  - Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
  - Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
   
  If this policy setting is disabled, "Disable all with notification" will be the default setting.
   
  If this policy setting is not configured, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document.
   
  Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Trust Center >> VBA Macro Notification Settings >> VBA Macro Notification Settings must be set to "Enabled" and "Disable all except digitally signed macros".

check_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Trust Center >> VBA Macro Notification Settings >> VBA Macro Notification Settings to "Enabled" "Disable all except digitally signed macros".
   
  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\publisher\security

  If the value vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD = 4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.


vuln_id: V-223393
rule_id: SV-223393r960963_rule
severity: CAT II
title: VBA Macros not digitally signed must be blocked in Visio.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

  If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:

  - Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. This option also allows users to potentially enable unsigned/untrusted macros.  If a site requires the use of macros, they must be signed /approved and added to appropriate locations listed in the Trust Center Settings. 
  - Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
  - Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
  - Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.

  If you disable this policy setting, "Disable all with notification" will be the default setting.

  If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document.

  Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates/Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> VBA Macro Notification Settings to "Enabled" and select "Disable all except digitally signed macros".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates/Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Enabled" and "Disable all except digitally signed macros".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\visio\security

  If the value for vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD =  4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.


vuln_id: V-223394
rule_id: SV-223394r961092_rule
severity: CAT II
title: Trusted Locations on the network must be disabled in Visio.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether trusted locations on the network can be used.

  If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

  If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

  If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

  Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting as the "Allow Trusted Locations on my network (not recommended)" check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

  If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Allow Trusted Locations on the network to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Allow Trusted Locations on the network is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\visio\security\trusted locations

  If the value for allownetworklocations is REG_DWORD = 0, this is not a finding.


vuln_id: V-223395
rule_id: SV-223395r1016173_rule
severity: CAT II
title: Visio must automatically disable unsigned add-ins without informing users.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if the "Require that application add-ins are signed by Trusted Publisher" policy setting is enabled, which prevents users from changing this policy setting.

  If this policy setting is enabled, applications automatically disable unsigned add-ins without informing users.
   
  If this policy setting is disabled, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.

  If this policy setting is not configured, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them to Enabled.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them is set to Enabled.
   
  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\visio\security

  If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.


vuln_id: V-223396
rule_id: SV-223396r961086_rule
severity: CAT II
title: Visio 2000-2002 Binary Drawings, Templates and Stencils must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting.

  If you enable this policy setting, you can specify whether users can open or save files.

  The options that can be selected are below. Note: Not all options may be available for this policy setting.

  -Do not block: The file type will not be blocked.
  -Save blocked: Saving of the filet type will be blocked.
  -Open/Save blocked: Both opening and saving of the file type will be blocked.

  If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2000-2002 Binary Drawings, Templates and Stencils" to "Enabled" and "Open/Save blocked".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2000-2002 Binary Drawings, Templates and Stencils" is set to "Enabled" and "Open/Save blocked".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\visio\security\fileblock

  If the value "visio2000files" is REG_DWORD = 2, this is not a finding.


vuln_id: V-223397
rule_id: SV-223397r961086_rule
severity: CAT II
title: Visio 2003-2010 Binary Drawings, Templates and Stencils must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting.

  If you enable this policy setting, you can specify whether users can open or save files.

  The options that can be selected are below. Note: Not all options may be available for this policy setting.

  -Do not block: The file type will not be blocked.
  -Save blocked: Saving of the filet type will be blocked.
  -Open/Save blocked: Both opening and saving of the file type will be blocked.

  If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2003-2010 Binary Drawings, Templates and Stencils" to "Enabled" and "Open/Save blocked".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2003-2010 Binary Drawings, Templates and Stencils" is set to "Enabled" and "Open/Save blocked".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\visio\security\fileblock

  If the value "visio2003files" is REG_DWORD = 2, this is not a finding.


vuln_id: V-223398
rule_id: SV-223398r961086_rule
severity: CAT II
title: Visio 5.0 or earlier Binary Drawings, Templates and Stencils must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting.

  If you enable this policy setting, you can specify whether users can open or save files.

  The options that can be selected are below. Note: Not all options may be available for this policy setting.

  -Do not block: The file type will not be blocked.
  -Save blocked: Saving of the filet type will be blocked.
  -Open/Save blocked: Both opening and saving of the file type will be blocked.

  If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 5.0 or earlier Binary Drawings, Templates and Stencils" to "Enabled" and "Open/Save blocked".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 5.0 or earlier Binary Drawings, Templates and Stencils" is set to "Enabled" and "Open/Save blocked".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\visio\security\fileblock

  If the value "visio50andearlierfiles" is REG_DWORD = 2, this is not a finding.


vuln_id: V-223399
rule_id: SV-223399r961092_rule
severity: CAT II
title: Macros must be blocked from running in Visio files from the Internet.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet.

  If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content”, users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

  If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >>  Visio Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet  to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >>  Visio Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\visio\security

  If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.


vuln_id: V-223400
rule_id: SV-223400r1016174_rule
severity: CAT II
title: Word must automatically disable unsigned add-ins without informing users.
cci: CCI-003992,CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if the "Require that application add-ins are signed by Trusted Publisher" policy setting is enabled, which prevents users from changing this policy setting.

  If this policy setting is enabled, applications automatically disable unsigned add-ins without informing users.
   
  If this policy setting is disabled, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.

  If this policy setting is not configured, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\word\security

  If the value for notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.


vuln_id: V-223401
rule_id: SV-223401r961092_rule
severity: CAT II
title: In Word, encrypted macros must be scanned.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether encrypted macros in Open XML documents be are required to be scanned with anti-virus software before being opened.

  If you enable this policy setting, you may choose one of these options:
  - Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.
  - Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load.
  - Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

  If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Scan encrypted macros in Word Open XML documents to "Enabled" "Scan encrypted macros (default)".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Scan encrypted macros in Word Open XML documents is set to "Enabled" "Scan encrypted macros (default)".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\word\security

  If the value WordBypassEncryptedMacroScan does not exist, this is not a finding. If the value is REG_DWORD = 0, this is not a finding.


vuln_id: V-223402
rule_id: SV-223402r961086_rule
severity: CAT II
title: Files downloaded from the Internet must be opened in Protected view in Word.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

  If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

  If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy setting, User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View to "Disabled".

check_text:
  Verify the policy setting, User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\word\security\protectedview

  If the value for disableinternetfilesinpv is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding.

  If the value is REG_DWORD = 1, this is a finding.


vuln_id: V-223403
rule_id: SV-223403r961086_rule
severity: CAT II
title: Files located in unsafe locations must be opened in Protected view in Word.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting lets you determine if files located in unsafe locations will open in Protected View. If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

  If you enable this policy setting, files located in unsafe locations do not open in Protected View.

  If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy setting, User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\word\security\protectedview.

  If the value for disableunsafelocationsinpv is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding.

  If the value is REG_DWORD = 1, this is a finding.


vuln_id: V-223404
rule_id: SV-223404r961086_rule
severity: CAT II
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  If file validation fails, files must be opened in Protected view in Word with ability to edit disabled.

description:
  <VulnDiscussion>This policy setting controls how Office handles documents when they fail file validation. 

  If you enable this policy setting, you can configure the following options for files that fail file validation:
  - Block files completely. Users cannot open the files.
  - Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting.
  - Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting.

  If you disable this policy setting, Office follows the "Open files in Protected View and disallow edit" behavior.

  If you do not configure this policy setting, Office follows the "Open files in Protected View and allow edit" behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails to "Enabled: Open in Protected View". 

  Uncheck the "Allow edit" check box.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails is set to "Enabled: Open in Protected View". Verify the check box for "Allow edit" is not selected.

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\Word\security\filevalidation

  If the value openinprotectedview does not exist, this is not a finding. 

  If both the value for openinprotectedview is REG_DWORD = 1 and the value for DisableEditFromPV is set to REG_DWORD = 1, this is not a finding.


vuln_id: V-223405
rule_id: SV-223405r961086_rule
severity: CAT II
title: Word attachments opened from Outlook must be in Protected View.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine if Word files in Outlook attachments open in Protected View.

  If you enable this policy setting, Outlook attachments do not open in Protected View.

  If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security>> Trust Center>> Protected View >> Turn off Protected View for attachments opened from Outlook to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security>> Trust Center>> Protected View >> Turn off Protected View for attachments opened from Outlook is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\word\security\protectedview

  If the value for disableattachmentsinpv is REG_DWORD = 0, this is not a finding.


vuln_id: V-223406
rule_id: SV-223406r961086_rule
severity: CAT II
title: The default file block behavior must be set to not open blocked files in Word.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine if users can open, view, or edit Word files.

  If you enable this policy setting, you can set one of these options:
  - Blocked files are not opened.
  - Blocked files open in Protected View and cannot be edited.
  - Blocked files open in Protected View and can be edited.

  If you disable or do not configure this policy setting, the behavior is the same as the "Blocked files are not opened" setting. Users will not be able to open blocked files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" to "Enabled: Blocked files are not opened".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" is set to "Enabled: Blocked files are not opened".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value OpenInProtectedView is REG_DWORD = 0, this is not a finding.


vuln_id: V-223407
rule_id: SV-223407r961086_rule
severity: CAT II
title: Open/Save of Word 2 and earlier binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. 

  If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2 and earlier binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2 and earlier binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value Word2Files is REG_DWORD = 2, this is not a finding.


vuln_id: V-223408
rule_id: SV-223408r961086_rule
severity: CAT II
title: Open/Save of Word 2000 binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. 

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2000 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2000 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value Word2000Files is REG_DWORD = 2, this is not a finding.


vuln_id: V-223409
rule_id: SV-223409r961086_rule
severity: CAT II
title: Open/Save of Word 2003 binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. 

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2003 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2003 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value word2003files is REG_DWORD = 2, this is not a finding.


vuln_id: V-223410
rule_id: SV-223410r961086_rule
severity: CAT II
title: Open/Save of Word 2007 and later binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting.

  - Do not block: The file type will not be blocked.
  - Save blocked: Saving of the file type will be blocked.
  - Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.
  - Block: Both opening and saving of the file type will be blocked, and the file will not open.
  - Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.
  - Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. 

  If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2007 and later binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2007 and later binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value word2007files is REG_DWORD = 2, this is not a finding.


vuln_id: V-223411
rule_id: SV-223411r961086_rule
severity: CAT II
title: Open/Save of Word 6.0 binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1530 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 6.0 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 6.0 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value word60files is REG_DWORD = 2, this is not a finding.


vuln_id: V-223412
rule_id: SV-223412r961086_rule
severity: CAT II
title: Open/Save of Word 95 binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1530 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 95 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 95 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value word95files is REG_DWORD = 2, this is not a finding.


vuln_id: V-223413
rule_id: SV-223413r961086_rule
severity: CAT II
title: Open/Save of Word 97 binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1530 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 97 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 97 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value word97files is REG_DWORD = 2, this is not a finding.


vuln_id: V-223414
rule_id: SV-223414r961086_rule
severity: CAT II
title: Open/Save of Word XP binary documents and templates must be blocked.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
[cell repeats an earlier one in this file: 1530 characters]

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word XP binary documents and templates" to "Enabled: Open/Save blocked, use open policy".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word XP binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock

  If the value wordxpfiles is REG_DWORD = 2, this is not a finding.


vuln_id: V-223415
rule_id: SV-223415r961092_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
title:
  In Word, macros must be blocked from running, even if Enable all macros is selected in the Macro Settings section of the Trust Center.

description:
  <VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet. If you enable this policy setting, macros are blocked from running, even if "Enable all macros" is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to "Enable Content", users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run. 

  If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" to "Enabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" is set to "Enabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\Software\Policies\Microsoft\Office\16.0\word\security

  If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.


vuln_id: V-223416
rule_id: SV-223416r961092_rule
severity: CAT II
title: Trusted Locations on the network must be disabled in Word.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls whether trusted locations on the network can be used.

  If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

  If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

  If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

  Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting as the "Allow Trusted Locations on my network (not recommended)" check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

  If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Trusted Locations >> Allow Trusted Locations on the network to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Trusted Locations >> Allow Trusted Locations on the network is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\microsoft\office\16.0\word\security\trusted locations

  If the value for allownetworklocations is REG_DWORD = 0, this is not a finding.


vuln_id: V-223417
rule_id: SV-223417r960963_rule
severity: CAT II
title: VBA Macros not digitally signed must be blocked in Word.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

  If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:

  - Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. This option also allows users to potentially enable unsigned/untrusted macros.  If a site requires the use of macros, they must be signed /approved and added to appropriate locations listed in the Trust Center Settings. 
  - Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
  - Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
  - Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >>  Security >> Trust Center >> "VBA macro Notification Settings" to "Enabled" and "Disable all except digitally signed macros" from the Options.

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >>  Security >> Trust Center >> "VBA macro Notification Settings" is set to "Enabled" and "Disable all except digitally signed macros" from the Options. 

  Use the Windows Registry Editor to navigate to the following key:

  HKCU\software\policies\Microsoft\office\16.0\word\security

  If the value vbawarnings is REG_DWORD = 3, this is not a finding. A value of REG_DWORD =  4 is also acceptable. If the registry key does not exist or is not configured properly, this is a finding.


vuln_id: V-223418
rule_id: SV-223418r960921_rule
severity: CAT II
title: File validation in Word must be enabled.
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 14:14:58
description:
  <VulnDiscussion>This policy setting allows the file validation feature to be turned off.

  If this policy setting is enabled, file validation will be turned off.

  If this policy setting is disabled or not configured, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform to the file format schema before they are opened.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Turn off file validation to "Disabled".

check_text:
  Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Turn off file validation is set to "Disabled".

  Use the Windows Registry Editor to navigate to the following key: 

  HKCU\software\policies\microsoft\office\16.0\word\security\filevalidation

  If the value for enableonload is REG_DWORD = 1, this is not a finding.


vuln_id: V-220697
rule_id: SV-220697r991589_rule
severity: CAT II
title: Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.
fix_text: Use Windows 10 Enterprise 64-bit version for domain-joined systems.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Features such as Credential Guard use virtualization-based security to protect information that could be used in credential theft attacks if compromised. A number of system requirements must be met for Credential Guard to be configured and enabled properly. Virtualization-based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.

  For standalone or nondomain-joined systems, this is NA.

  Open "Settings".

  Select "System", then "About".

  If "Edition" is not "Windows 10 Enterprise", this is a finding.

  If "System type" is not "64-bit operating system…", this is a finding.


vuln_id: V-220698
rule_id: SV-220698r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.

description:
  <VulnDiscussion>Credential Guard uses virtualization-based security to protect information that could be used in credential theft attacks if compromised. A number of system requirements must be met for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For standalone or nondomain-joined systems, this is NA.

  Virtualization-based security, including Credential Guard, currently cannot be implemented in VDI due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Ensure domain-joined systems have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.)

  The TPM must be enabled in the firmware.

  Run "tpm.msc" for configuration options in Windows.

check_text:
  Verify domain-joined systems have a TPM enabled and ready for use.

  For standalone or nondomain-joined systems, this is NA.

  Virtualization-based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

  For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Verify the system has a TPM and is ready for use.
  Run "tpm.msc".
  Review the sections in the center pane.
  "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken".
  TPM Manufacturer Information - Specific Version = 2.0 or 1.2

  If a TPM is not found or is not ready for use, this is a finding.


vuln_id: V-220699
rule_id: SV-220699r991589_rule
severity: CAT II
fix_text: Configure UEFI firmware to run in UEFI mode, not Legacy BIOS mode.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.

description:
  <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS.

  Run "System Information".

  Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding.


vuln_id: V-220700
rule_id: SV-220700r991589_rule
severity: CAT III
title: Secure Boot must be enabled on Windows 10 systems.
fix_text: Enable Secure Boot in the system firmware.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. 

  For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  Run "System Information".

  Under "System Summary", if "Secure Boot State" does not display "On", this is finding.


vuln_id: V-220701
rule_id: SV-220701r1000076_rule
severity: CAT II
fix_text: Install DOD-approved ESS software and ensure it is operating continuously.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: Continuously, where ESS is used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).

description:
  <VulnDiscussion>An approved tool for continuous network scanning must be installed and configured to run.

  Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws.

  To support this requirement, the operating system may have an integrated solution incorporating continuous scanning using ESS and periodic scanning using other tools, as specified in the requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Verify DOD-approved ESS software is installed and properly operating. Ask the site information system security manager (ISSM) for documentation of the ESS software installation and configuration.

  If the ISSM is not able to provide a documented configuration for an installed ESS or if the ESS software is not properly maintained or used, this is a finding.

  Note: Example of documentation can be a copy of the site's CCB approved Software Baseline with version of software noted or a memo from the ISSM stating current ESS software and version.


vuln_id: V-220702
rule_id: SV-220702r958552_rule
severity: CAT I
cci: CCI-001199,CCI-002475,CCI-002476
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.

description:
  <VulnDiscussion>If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Enable full disk encryption on all information systems (including SIPRNet) using BitLocker.

  BitLocker, included in Windows, can be enabled in the Control Panel under "BitLocker Drive Encryption" as well as other management tools.

  NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).

check_text:
  Verify all Windows 10 information systems (including SIPRNet) employ BitLocker for full disk encryption.

  For virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  For Azure Virtual Desktop (AVD) implementations with no data at rest, this is NA.

  If full disk encryption using BitLocker is not implemented, this is a finding.

  Verify BitLocker is turned on for the operating system drive and any fixed data drives.

  Open "BitLocker Drive Encryption" from the Control Panel.

  If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding.

  NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).


vuln_id: V-220703
rule_id: SV-220703r958552_rule
severity: CAT I
title: Windows 10 systems must use a BitLocker PIN for pre-boot authentication.
cci: CCI-001199,CCI-002475,CCI-002476
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives "Require additional authentication at startup" to "Enabled" with "Configure TPM Startup PIN:" set to "Require startup PIN with TPM" or with "Configure TPM startup key and PIN:" set to "Require startup key and PIN with TPM".

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  For virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  For Azure Virtual Desktop (AVD) implementations with no data at rest, this is NA.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\FVE\

  Value Name: UseAdvancedStartup
  Type: REG_DWORD
  Value: 0x00000001 (1)

  If one of the following registry values does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\FVE\

  Value Name: UseTPMPIN
  Type: REG_DWORD
  Value: 0x00000001 (1)

  Value Name: UseTPMKeyPIN
  Type: REG_DWORD
  Value: 0x00000001 (1)

  When BitLocker network unlock is used:

  Value Name: UseTPMPIN
  Type: REG_DWORD
  Value: 0x00000002 (2)

  Value Name: UseTPMKeyPIN
  Type: REG_DWORD
  Value: 0x00000002 (2)

  BitLocker network unlock may be used in conjunction with a BitLocker PIN. Refer to the article at the link below for information about network unlock.

  https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock


vuln_id: V-220704
rule_id: SV-220704r958552_rule
severity: CAT I
cci: CCI-001199,CCI-002475,CCI-002476
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.

description:
  <VulnDiscussion>If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the PIN length requires a greater number of guesses for an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives "Configure minimum PIN length for startup" to "Enabled" with "Minimum characters:" set to "6" or greater.

check_text:
  If the following registry value does not exist or is not configured as specified, this is a finding.

  For virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

  For Azure Virtual Desktop (AVD) implementations with no data at rest, this is NA.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\FVE\

  Value Name: MinimumPIN
  Type: REG_DWORD
  Value: 0x00000006 (6) or greater


vuln_id: V-220705
rule_id: SV-220705r958808_rule
severity: CAT II
cci: CCI-001774
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

description:
  <VulnDiscussion>Utilizing an allowlist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.

  The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as allowlisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure an application allowlisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

  Configuration of allowlisting applications will vary by the program. AppLocker is an allowlisting application built into Windows 10 Enterprise.

  If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker.

  Implementation guidance for AppLocker is available at the following link:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide

check_text:
  Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universal apps installed by default on systems.

  If an application allowlisting program is not in use on the system, this is a finding.

  Configuration of allowlisting applications will vary by the program.

  AppLocker is an allowlisting application built into Windows 10 Enterprise. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.

  If AppLocker is used, perform the following to view the configuration of AppLocker:
  Run "PowerShell".

  Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system:
  Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml

  This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.

  Implementation guidance for AppLocker is available at the following link:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide


vuln_id: V-220706
rule_id: SV-220706r1153413_rule
severity: CAT I
title: Windows 10 systems must be maintained at a supported servicing level.
fix_text: Upgrade to a supported version of the operating system.
cci: CCI-003376
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities, which leaves them subject to exploitation.

  New versions with feature updates are planned to be released on a semiannual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions.

  A separate servicing branch intended for special-purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB), which will receive security updates for 10 years but excludes feature updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Run "winver.exe".

  If the "About Windows" dialog box does not display a version supported by the vendor, this is a finding.


vuln_id: V-220707
rule_id: SV-220707r1016358_rule
severity: CAT I
title: The Windows 10 system must use an anti-virus program.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If no antivirus software is on the system and in use, install Windows Defender or a third-party antivirus solution.

check_text:
  Verify an antivirus solution is installed on the system and in use. The antivirus solution may be bundled with an approved Endpoint Security Solution.

  Verify if Windows Defender is in use or enabled:

  Open "PowerShell".

  Enter "get-service | where {$_.DisplayName -Like "*Defender*"} | Select Status,DisplayName"

  Verify third-party antivirus is in use or enabled:

  Open "PowerShell".

  Enter "get-service | where {$_.DisplayName -Like "*mcafee*"} | Select Status,DisplayName"

  Enter "get-service | where {$_.DisplayName -Like "*symantec*"} | Select Status,DisplayName"
                                        
  Enter "get-service | where {$_.DisplayName -Like "*trellix*"} | Select Status,DisplayName" 
                                                             
  If there is no antivirus solution installed on the system, this is a finding.


vuln_id: V-220708
rule_id: SV-220708r1137691_rule
severity: CAT I
title: Local volumes must be formatted using NTFS.
fix_text: Format all local volumes to use NTFS.
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system.  To support this, volumes must be formatted using the NTFS file system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Run "Computer Management".
  Navigate to Storage >> Disk Management.

  If the "File System" column does not indicate "NTFS" for each volume assigned a drive letter, this is a finding.

  This does not apply to system partitions such the Recovery and EFI System Partition.


vuln_id: V-220709
rule_id: SV-220709r991589_rule
severity: CAT II
title: Alternate operating systems must not be permitted on the same system.
fix_text: Ensure Windows 10 is the only operating system on a device. Remove alternate operating systems.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Allowing other operating systems to run on a secure system may allow security to be circumvented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Verify the system does not include other operating system installations.

  Run "Advanced System Settings".
  Select the "Advanced" tab.
  Click the "Settings" button in the "Startup and Recovery" section.

  If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.


vuln_id: V-220710
rule_id: SV-220710r1137695_rule
severity: CAT II
title: Non system-created file shares on a system must limit access to groups that require it.
cci: CCI-001090
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it.

  Remove any unnecessary non-system created shares.

check_text:
  Non system-created shares should not typically exist on workstations.

  If only system-created shares exist on the system this is NA.

  Run "Computer Management".
  Navigate to System Tools >> Shared Folders >> Shares.

  If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA.
  (Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)

  Right click any non-system-created shares.
  Select "Properties".
  Select the "Share Permissions" tab.

  Verify the necessity of any shares found.
  If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.

  Select the "Security" tab.

  If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.


vuln_id: V-220711
rule_id: SV-220711r1051018_rule
severity: CAT III
title: Unused accounts must be disabled or removed from the system after 35 days of inactivity.
cci: CCI-003627,CCI-000795
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Regularly review local accounts and verify their necessity. Disable or delete any active accounts that have not been used in the last 35 days.

check_text:
  Run "PowerShell".
  Copy the lines below to the PowerShell window and enter.

  "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach {
     $user = ([ADSI]$_.Path)
     $lastLogin = $user.Properties.LastLogin.Value
     $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2
     if ($lastLogin -eq $null) {
        $lastLogin = 'Never'
     }
     Write-Host $user.Name $lastLogin $enabled 
  }"

  This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False).
  For example: User1  10/31/2015  5:49:56  AM  True

  Review the list to determine the finding validity for each account reported.

  Exclude the following accounts:
  Built-in administrator account (Disabled, SID ending in 500)
  Built-in guest account (Disabled, SID ending in 501)
  Built-in DefaultAccount (Disabled, SID ending in 503)
  Local administrator account

  If any enabled accounts have not been logged on to within the past 35 days, this is a finding.

  Inactive accounts that have been reviewed and deemed to be required must be documented with the information system security officer (ISSO).


vuln_id: V-220712
rule_id: SV-220712r958726_rule
severity: CAT I
cci: CCI-002235
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Only accounts responsible for the administration of a system must have Administrator rights on the system.

description:
  <VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.

  System administrators must log on to systems only using accounts with the minimum level of authority necessary.

  For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.

  Standard user accounts must not be members of the local administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.

  For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.

  Remove any standard user accounts.

check_text:
  Run "Computer Management".
  Navigate to System Tools >> Local Users and Groups >> Groups.
  Review the members of the Administrators group.
  Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.

  For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.

  Standard user accounts must not be members of the local administrator group.

  If prohibited accounts are members of the local administrators group, this is a finding.

  The built-in Administrator account or other required administrative accounts would not be a finding.


vuln_id: V-220713
rule_id: SV-220713r991589_rule
severity: CAT II
title: Only accounts responsible for the backup operations must be members of the Backup Operators group.
fix_text: Create separate accounts for backup operations for users with this privilege.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Run "Computer Management".
  Navigate to System Tools >> Local Users and Groups >> Groups.
  Review the members of the Backup Operators group.

  If the group contains no accounts, this is not a finding.

  If the group contains any accounts, the accounts must be specifically for backup functions.

  If the group contains any standard user accounts used for performing normal user tasks, this is a finding.


vuln_id: V-220714
rule_id: SV-220714r958478_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.

description:
  <VulnDiscussion>Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. The Hyper-V Hypervisor is used by Virtualization Based Security features such as Credential Guard on Windows 10; however, it is not the full Hyper-V installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  For Hyper-V, remove any unauthorized groups or user accounts from the "Hyper-V Administrators" group.

  For hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.

check_text:
  If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines.

  For Hyper-V, Run "Computer Management".
  Navigate to System Tools >> Local Users and Groups >> Groups.
  Double click on "Hyper-V Administrators".

  If any unauthorized groups or user accounts are listed in "Members:", this is a finding.

  For hosted hypervisors other than Hyper-V, verify only authorized user accounts have access to run the virtual machines. Restrictions may be enforced by access to the physical system, software restriction policies, or access restrictions built in to the application.

  If any unauthorized groups or user accounts have access to create or run virtual machines, this is a finding.

  All users authorized to create or run virtual machines must be documented with the ISSM/ISSO. Accounts nested within group accounts must be documented as individual accounts and not the group accounts.


vuln_id: V-220715
rule_id: SV-220715r991589_rule
severity: CAT III
title: Standard local user accounts must not exist on a system in a domain.
fix_text: Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log on to workstations in a domain with their domain accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  For standalone or nondomain-joined systems, this is Not Applicable.

  Run "Computer Management".

  Navigate to System Tools >> Local Users and Groups >> Users.

  If local users other than the accounts listed below exist on a workstation in a domain, this is a finding.

  Built-in Administrator account (Disabled)
  Built-in Guest account (Disabled)
  Built-in DefaultAccount (Disabled)
  Built-in defaultuser0 (Disabled)
  Built-in WDAGUtilityAccount (Disabled)
  Local administrator account(s)

  All of the built-in accounts may not exist on a system, depending on the Windows 10 version.


vuln_id: V-220716
rule_id: SV-220716r1051019_rule
severity: CAT II
title: Accounts must be configured to require password expiration.
cci: CCI-004066,CCI-000199
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure all passwords to expire.
  Run "Computer Management".
  Navigate to System Tools >> Local Users and Groups >> Users.
  Double-click each active account.
  Ensure "Password never expires" is not checked on all active accounts.

check_text:
  Run "Computer Management".
  Navigate to System Tools >> Local Users and Groups >> Users.
  Double-click each active account.

  If "Password never expires" is selected for any account, this is a finding.


vuln_id: V-220717
rule_id: SV-220717r1081048_rule
severity: CAT II
title: Permissions for system files and directories must conform to minimum requirements.
cci: CCI-002165
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Maintain the default file system permissions and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN10-SO-000160).

check_text:
  The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160).

  If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding.

  Verify the default permissions for the sample directories below. Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)

  Viewing in File Explorer:
  Select the "Security" tab and then select "Advanced".

  C:\ 
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  Administrators - Full control - This folder, subfolders and files
  SYSTEM - Full control - This folder, subfolders and files
  Users - Read & execute - This folder, subfolders and files
  Authenticated Users - Modify - Subfolders and files only
  Authenticated Users - Create folders / append data - This folder only

  \Program Files
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  TrustedInstaller - Full control - This folder and subfolders
  SYSTEM - Modify - This folder only
  SYSTEM - Full control - Subfolders and files only
  Administrators - Modify - This folder only
  Administrators - Full control - Subfolders and files only
  Users - Read & execute - This folder, subfolders and files
  CREATOR OWNER - Full control - Subfolders and files only
  ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files
  ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files

  \Windows
  Type - "Allow" for all
  Inherited from - "None" for all
  Principal - Access - Applies to
  TrustedInstaller - Full control - This folder and subfolders
  SYSTEM - Modify - This folder only
  SYSTEM - Full control - Subfolders and files only
  Administrators - Modify - This folder only
  Administrators - Full control - Subfolders and files only
  Users - Read & execute - This folder, subfolders and files
  CREATOR OWNER - Full control - Subfolders and files only
  ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files
  ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files

  Alternately use icacls.

  Run "CMD" as administrator.
  Enter "icacls" followed by the directory.

  icacls c:\
  icacls "c:\program files"
  icacls c:\windows

  The following results will be displayed as each is entered:

  c:\ S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176 (S,RD,X,RA)
  BUILTIN\Administrators:(OI)(CI)(F)
  NT AUTHORITY\SYSTEM:(OI)(CI)(F)
  BUILTIN\Users:(OI)(CI)(RX)
  NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M)
  NT AUTHORITY\Authenticated Users:(AD)
  Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW)
  Successfully processed 1 files; Failed processing 0 files

  c:\program files 
  NT SERVICE\TrustedInstaller:(F)
  NT SERVICE\TrustedInstaller:(CI)(IO)(F)
  NT AUTHORITY\SYSTEM:(M)
  NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
  BUILTIN\Administrators:(M)
  BUILTIN\Administrators:(OI)(CI)(IO)(F)
  BUILTIN\Users:(RX)
  BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
  CREATOR OWNER:(OI)(CI)(IO)(F)
  APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
  APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
  APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
  APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
  Successfully processed 1 files; Failed processing 0 files

  c:\windows
  NT SERVICE\TrustedInstaller:(F)
  NT SERVICE\TrustedInstaller:(CI)(IO)(F)
  NT AUTHORITY\SYSTEM:(M)
  NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
  BUILTIN\Administrators:(M)
  BUILTIN\Administrators:(OI)(CI)(IO)(F)
  BUILTIN\Users:(RX)
  BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
  CREATOR OWNER:(OI)(CI)(IO)(F)
  APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
  APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
  APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
  APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
  Successfully processed 1 files; Failed processing 0 files


vuln_id: V-220718
rule_id: SV-220718r958478_rule
severity: CAT I
title: Internet Information System (IIS) or its subcomponents must not be installed on a workstation.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted.  Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Uninstall "Internet Information Services" or "Internet Information Services Hostable Web Core" from the system.

check_text:
  IIS is not installed by default.  Verify it has not been installed on the system.

  Run "Programs and Features".
  Select "Turn Windows features on or off".

  If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, this is a finding.

  If an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO.  In addition, any applicable requirements from the IIS STIG must be addressed.


vuln_id: V-220719
rule_id: SV-220719r958480_rule
severity: CAT II
title: Simple Network Management Protocol (SNMP) must not be installed on the system.
cci: CCI-000382
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some protocols and services do not support required security features, such as encrypting passwords or traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Uninstall "Simple Network Management Protocol (SNMP)" from the system.

  Run "Programs and Features".
  Select "Turn Windows Features on or off".
  De-select "Simple Network Management Protocol (SNMP)".

check_text:
  "SNMP" is not installed by default.  Verify it has not been installed.

  Navigate to the Windows\System32 directory.

  If the "SNMP" application exists, this is a finding.


vuln_id: V-220720
rule_id: SV-220720r958478_rule
severity: CAT II
title: Simple TCP/IP Services must not be installed on the system.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some protocols and services do not support required security features, such as encrypting passwords or traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Uninstall "Simple TCPIP Services (i.e. echo, daytime etc)" from the system.

  Run "Programs and Features".
  Select "Turn Windows Features on or off".
  De-select "Simple TCPIP Services (i.e. echo, daytime etc)".

check_text:
  "Simple TCP/IP Services" is not installed by default.  Verify it has not been installed.

  Run "Services.msc".

  If "Simple TCP/IP Services" is listed, this is a finding.


vuln_id: V-220721
rule_id: SV-220721r958480_rule
severity: CAT II
title: The Telnet Client must not be installed on the system.
cci: CCI-000382
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Some protocols and services do not support required security features, such as encrypting passwords or traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Uninstall "Telnet Client" from the system.

  Run "Programs and Features".
  Select "Turn Windows Features on or off".

  De-select "Telnet Client".

check_text:
  The "Telnet Client" is not installed by default.  Verify it has not been installed.

  Navigate to the Windows\System32 directory.

  If the "telnet" application exists, this is a finding.


vuln_id: V-220722
rule_id: SV-220722r958480_rule
severity: CAT II
title: The TFTP Client must not be installed on the system.
cci: CCI-000382
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
[cell repeats an earlier one in this file: 493 characters]

fix_text:
  Uninstall "TFTP Client" from the system.

  Run "Programs and Features".
  Select "Turn Windows Features on or off".

  De-select "TFTP Client".

check_text:
  The "TFTP Client" is not installed by default.  Verify it has not been installed.

  Navigate to the Windows\System32 directory.

  If the "TFTP" application exists, this is a finding.


vuln_id: V-220723
rule_id: SV-220723r991589_rule
severity: CAT II
title: Software certificate installation files must be removed from Windows 10.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove any certificate installation files (*.p12 and *.pfx) found on a system.

  Note: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files.

check_text:
  Search all drives for *.p12 and *.pfx files.

  If any files with these extensions exist, this is a finding.

  This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.


vuln_id: V-220724
rule_id: SV-220724r991589_rule
severity: CAT II
title: A host-based firewall must be installed and enabled on the system.
fix_text: Install and enable a host-based firewall on the system.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.

  The configuration requirements will be determined by the applicable firewall STIG.


vuln_id: V-220725
rule_id: SV-220725r991589_rule
severity: CAT II
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.

description:
  <VulnDiscussion>Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts.

  Configure only inbound connection exceptions for authorized remote management hosts.
  Computer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)

  For any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles.

  If a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.

check_text:
  Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.

  If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.

  Review inbound firewall exceptions.
  Computer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)

  For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.

  If a third-party firewall is used, ensure comparable settings are in place.


vuln_id: V-220726
rule_id: SV-220726r958928_rule
severity: CAT I
title: Data Execution Prevention (DEP) must be configured to at least OptOut.
cci: CCI-002824
deprecated_at: 2026-03-05 13:41:37
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure DEP to at least OptOut.

  Note: Suspend BitLocker before making changes to the DEP configuration.

  Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
  Enter "BCDEDIT /set {current} nx OptOut".  (If using PowerShell "{current}" must be enclosed in quotes.)
  "AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.

  Opted out exceptions can be configured in the "System Properties".

  Open "System" in Control Panel.
  Select "Advanced system settings".
  Click "Settings" in the "Performance" section.
  Select the "Data Execution Prevention" tab.
  Applications that are opted out are configured in the window below the selection "Turn on DEP for all programs and services except those I select:".

check_text:
  Verify the DEP configuration.
  Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
  Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.)
  If the value for "nx" is not "OptOut", this is a finding.
  (The more restrictive configuration of "AlwaysOn" would not be a finding.)


vuln_id: V-220727
rule_id: SV-220727r958928_rule
severity: CAT I
title: Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
cci: CCI-002824
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handling overwrite technique, a common buffer overflow attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Enable Structured Exception Handling Overwrite Protection (SEHOP)" to "Enabled".

  This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

check_text:
  This is applicable to Windows 10 prior to v1709.

  Verify SEHOP is turned on.

  If the following registry value does not exist or is not configured as specified, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\kernel\

  Value Name: DisableExceptionChainValidation

  Value Type: REG_DWORD
  Value: 0x00000000 (0)


vuln_id: V-220728
rule_id: SV-220728r958478_rule
severity: CAT II
title: The Windows PowerShell 2.0 feature must be disabled on the system.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system.  Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable "Windows PowerShell 2.0" on the system.

  Run "Windows PowerShell" with elevated privileges (run as administrator).
  Enter the following:
  Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

  This command should disable both "MicrosoftWindowsPowerShellV2Root" and "MicrosoftWindowsPowerShellV2" which correspond to "Windows PowerShell 2.0" and "Windows PowerShell 2.0 Engine" respectively in "Turn Windows features on or off".

  Alternately:
  Search for "Features".
  Select "Turn Windows features on or off".
  De-select "Windows PowerShell 2.0".

check_text:
  Run "Windows PowerShell" with elevated privileges (run as administrator).

  Enter the following:
  Get-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShellv2*

  If either of the following have a "State" of "Enabled", this is a finding.

  FeatureName : MicrosoftWindowsPowerShellV2
  State : Enabled
  FeatureName : MicrosoftWindowsPowerShellV2Root
  State : Enabled

  Alternately:
  Search for "Features".

  Select "Turn Windows features on or off".

  If "Windows PowerShell 2.0" (whether the subcategory of "Windows PowerShell 2.0 Engine" is selected or not) is selected, this is a finding.


vuln_id: V-220729
rule_id: SV-220729r958478_rule
severity: CAT II
title: The Server Message Block (SMB) v1 protocol must be disabled on the system.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.

  Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older Network Attached Storage (NAS) devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Disable the SMBv1 protocol.

  Run "Windows PowerShell" with elevated privileges (run as administrator).

  Enter the following:
  Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

  Alternately:
  Search for "Features".

  Select "Turn Windows features on or off".

  De-select "SMB 1.0/CIFS File Sharing Support".

check_text:
  Different methods are available to disable SMBv1 on Windows 10.  This is the preferred method, however if V-220730 and V-220731 are configured, this is NA.

  Run "Windows PowerShell" with elevated privileges (run as administrator).

  Enter the following:
  Get-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol

  If "State : Enabled" is returned, this is a finding.

  Alternately:
  Search for "Features".

  Select "Turn Windows features on or off".

  If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding.


vuln_id: V-220730
rule_id: SV-220730r958478_rule
severity: CAT II
title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.

  Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled".

  This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.   

  The system must be restarted for the change to take effect.

check_text:
  Different methods are available to disable SMBv1 on Windows 10, if V-220729 is configured, this is NA.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\

  Value Name: SMB1

  Type: REG_DWORD
  Value: 0x00000000 (0)


vuln_id: V-220731
rule_id: SV-220731r958478_rule
severity: CAT II
title: The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.

  Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver".

  This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.   

  The system must be restarted for the changes to take effect.

check_text:
  Different methods are available to disable SMBv1 on Windows 10, if V-220729 is configured, this is NA.

  If the following registry value is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\

  Value Name: Start

  Type: REG_DWORD
  Value: 0x00000004 (4)


vuln_id: V-220732
rule_id: SV-220732r958478_rule
severity: CAT II
title: The Secondary Logon service must be disabled on Windows 10.
fix_text: Configure the "Secondary Logon" service "Startup Type" to "Disabled".
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges.  Using privileged credentials in a standard user session can expose those credentials to theft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Run "Services.msc".

  Locate the "Secondary Logon" service.

  If the "Startup Type" is not "Disabled" or the "Status" is "Running", this is a finding.


vuln_id: V-220733
rule_id: SV-220733r991589_rule
severity: CAT II
title: Orphaned security identifiers (SIDs) must be removed from user rights on Windows 10.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.

check_text:
  Review the effective User Rights setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

  Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".)

  If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.


vuln_id: V-220734
rule_id: SV-220734r1153416_rule
severity: CAT II
title: Bluetooth must be turned off unless approved by the organization.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Turn off Bluetooth radios not organizationally approved.

  For systems managed by Intune, apply the DOD Windows 10 STIG Settings Catalog (or equivalent Intune policy) found in the Intune policy package available on cyber.mil.
  Steps to create an Intune policy:
  1. Sign in to the Intune admin center >> Devices >> Configuration >> Create >> New Policy.
  2. Platform: Windows 10 and later. Profile type: Settings Catalog, then click "Create".
  3. Basics: Provide a Name and Description of the profile, then click "Next".
  4. Configuration settings: Click "+ Add settings" and search for connectivity under the Settings picker. Under the Connectivity category, check the box next to Allow Bluetooth setting. Choose the first option, Disallow Bluetooth, then click "Next".
  5. Scope tags: (optional), then click "Next".
  6. Assignments: Assign the policy to Entra security groups that contain the target users or devices, then click "Next".
  7. Review + create: Review the deployment summary, then click "Create".

check_text:
  This is NA if the system does not have Bluetooth.

  Verify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding.

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity\

  Value Name: AllowBluetooth

  Value Type: REG_DWORD
  Value: 0x00000000 (0)

  Approval must be documented with the ISSO.


vuln_id: V-220735
rule_id: SV-220735r958478_rule
severity: CAT II
title: Bluetooth must be turned off when not in use.
cci: CCI-000381
deprecated_at: 2026-03-05 13:41:37
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Turn off Bluetooth radios when not in use. Establish an organizational policy for the use of Bluetooth to include training of personnel.

check_text:
  This is NA if the system does not have Bluetooth.

  Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.


vuln_id: V-220736
rule_id: SV-220736r991589_rule
severity: CAT II
title: The system must notify the user when a Bluetooth device attempts to connect.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure Bluetooth to notify users if devices attempt to connect.
  View Bluetooth Settings.
  Ensure "Alert me when a new Bluetooth device wants to connect" is checked.

check_text:
  This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy.

  Search for "Bluetooth".
  View Bluetooth Settings.
  Select "More Bluetooth Options"
  If "Alert me when a new Bluetooth device wants to connect" is not checked, this is a finding.


vuln_id: V-220737
rule_id: SV-220737r991589_rule
severity: CAT I
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.

description:
  <VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.

  Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.

  The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.

  Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.

  Implement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.

check_text:
  Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.

  The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.

  Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. 

  If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.


vuln_id: V-220738
rule_id: SV-220738r958552_rule
severity: CAT II
title: Windows 10 nonpersistent VM sessions must not exceed 24 hours.
fix_text: Set nonpersistent VM sessions to not exceed 24 hours.
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization should enforce that sessions be terminated within 24 hours. This would ensure any data stored on the VM that is not encrypted or covered by Credential Guard is deleted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Ensure there is a documented policy or procedure in place that nonpersistent VM sessions do not exceed 24 hours. If the system is NOT a nonpersistent VM, this is Not Applicable.

  If no such documented policy or procedure is in place, this is a finding.


vuln_id: V-220739
rule_id: SV-220739r958736_rule
severity: CAT II
title: Windows 10 account lockout duration must be configured to 15 minutes or greater.
cci: CCI-002238
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system.   This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater.

  A value of "0" is also acceptable, requiring an administrator to unlock the account.

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.

  If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding.

  Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.


vuln_id: V-220740
rule_id: SV-220740r958388_rule
severity: CAT II
title: The number of allowed bad logon attempts must be configured to 3 or less.
cci: CCI-000044
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0" which is unacceptable).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.

  If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding.


vuln_id: V-220741
rule_id: SV-220741r958388_rule
severity: CAT II
title: The period of time before the bad logon counter is reset must be configured to 15 minutes.
cci: CCI-000044,CCI-002238
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system.  This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to 0.  The smaller this value is, the less effective the account lockout feature will be in protecting the local system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to "15" minutes.

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.

  If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding.


vuln_id: V-220742
rule_id: SV-220742r1000079_rule
severity: CAT II
title: The password history must be configured to 24 passwords remembered.
cci: CCI-004061
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DOD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.

  If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding.


vuln_id: V-220743
rule_id: SV-220743r1051020_rule
severity: CAT II
title: The maximum password age must be configured to 60 days or less.
cci: CCI-004066,CCI-000199
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum Password Age" to "60" days or less (excluding "0" which is unacceptable).

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.

  If the value for the "Maximum password age" is greater than "60" days, this is a finding.  If the value is set to "0" (never expires), this is a finding.


vuln_id: V-220744
rule_id: SV-220744r1051021_rule
severity: CAT II
title: The minimum password age must be configured to at least 1 day.
cci: CCI-004066,CCI-000198
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum Password Age" to at least "1" day.

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.

  If the value for the "Minimum password age" is less than "1" day, this is a finding.


vuln_id: V-220745
rule_id: SV-220745r1051022_rule
severity: CAT II
title: Passwords must, at a minimum, be 14 characters.
cci: CCI-004066,CCI-000205
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length" to "14" characters.

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.

  If the value for the "Minimum password length," is less than "14" characters, this is a finding.


vuln_id: V-220746
rule_id: SV-220746r1051023_rule
severity: CAT II
title: The built-in Microsoft password complexity filter must be enabled.
cci: CCI-000192,CCI-000193,CCI-000194,CCI-001619
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>The use of complex passwords increases their strength against guessing and brute-force attacks.  This setting configures the system to verify that newly created passwords conform to the Windows password complexity policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.

  If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding.

  If the site is using a password filter that requires this setting be set to "Disabled" for the filter to be used, this would not be considered a finding.


vuln_id: V-220747
rule_id: SV-220747r1051024_rule
severity: CAT I
title: Reversible password encryption must be disabled.
cci: CCI-004062,CCI-000196
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled".

check_text:
  Verify the effective setting in Local Group Policy Editor.
  Run "gpedit.msc".

  Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.

  If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding.


vuln_id: V-220748
rule_id: SV-220748r991578_rule
severity: CAT II
title: The system must be configured to audit Account Logon - Credential Validation failures.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Account Logon >> Credential Validation - Failure


vuln_id: V-220749
rule_id: SV-220749r991578_rule
severity: CAT II
title: The system must be configured to audit Account Logon - Credential Validation successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Account Logon >> Credential Validation - Success


vuln_id: V-220750
rule_id: SV-220750r958368_rule
severity: CAT II
title: The system must be configured to audit Account Management - Security Group Management successes.
cci: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-002130,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Security Group Management records events such as creating, deleting or changing of security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Account Management >> Security Group Management - Success


vuln_id: V-220751
rule_id: SV-220751r958368_rule
severity: CAT II
title: The system must be configured to audit Account Management - User Account Management failures.
cci: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-002130,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Account Management >> User Account Management - Failure


vuln_id: V-220752
rule_id: SV-220752r958368_rule
severity: CAT II
title: The system must be configured to audit Account Management - User Account Management successes.
cci: CCI-000018,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-002130,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Account Management >> User Account Management - Success


vuln_id: V-220753
rule_id: SV-220753r1051025_rule
severity: CAT II
title: The system must be configured to audit Detailed Tracking - PNP Activity successes.
cci: CCI-000172,CCI-003938,CCI-001814
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Plug and Play activity records events related to the successful connection of external devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit PNP Activity" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Detailed Tracking >> Plug and Play Events - Success


vuln_id: V-220754
rule_id: SV-220754r1051026_rule
severity: CAT II
title: The system must be configured to audit Detailed Tracking - Process Creation successes.
cci: CCI-000172,CCI-003938,CCI-001814
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Process creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit Process Creation" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Detailed Tracking >> Process Creation - Success


vuln_id: V-220755
rule_id: SV-220755r991578_rule
severity: CAT II
title: The system must be configured to audit Logon/Logoff - Account Lockout failures.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Account Lockout events can be used to identify potentially malicious logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:

  Open a Command Prompt with elevated privileges ("Run as Administrator").

  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Logon/Logoff >> Account Lockout - Failure


vuln_id: V-220756
rule_id: SV-220756r991578_rule
severity: CAT II
title: The system must be configured to audit Logon/Logoff - Group Membership successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Group Membership records information related to the group membership of a user's logon token.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Group Membership" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Logon/Logoff >> Group Membership - Success


vuln_id: V-220757
rule_id: SV-220757r958406_rule
severity: CAT II
title: The system must be configured to audit Logon/Logoff - Logoff successes.
cci: CCI-000067,CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logoff" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Logon/Logoff >> Logoff - Success


vuln_id: V-220758
rule_id: SV-220758r958406_rule
severity: CAT II
title: The system must be configured to audit Logon/Logoff - Logon failures.
cci: CCI-000067,CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Logon/Logoff >> Logon - Failure


vuln_id: V-220759
rule_id: SV-220759r958406_rule
severity: CAT II
title: The system must be configured to audit Logon/Logoff - Logon successes.
cci: CCI-000067,CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Logon/Logoff >> Logon - Success


vuln_id: V-220760
rule_id: SV-220760r991578_rule
severity: CAT II
title: The system must be configured to audit Logon/Logoff - Special Logon successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Special Logon" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Logon/Logoff >> Special Logon - Success


vuln_id: V-220761
rule_id: SV-220761r991583_rule
severity: CAT II
title: Windows 10 must be configured to audit Object Access - File Share failures.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Auditing file shares records events related to connection to shares on a system including system shares such as C$.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit File Share" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:

  Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator").

  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following:

  Object Access >> File Share - Failure

  If the system does not audit the above, this is a finding.


vuln_id: V-220762
rule_id: SV-220762r991583_rule
severity: CAT II
title: Windows 10 must be configured to audit Object Access - File Share successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Auditing file shares records events related to connection to shares on a system including system shares such as C$.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit File Share" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:

  Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following:

  Object Access >> File Share - Success

  If the system does not audit the above, this is a finding.


vuln_id: V-220763
rule_id: SV-220763r991583_rule
severity: CAT II
title: Windows 10 must be configured to audit Object Access - Other Object Access Events successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:

  Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator").

  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following:

  Object Access >> Other Object Access Events - Success

  If the system does not audit the above, this is a finding.


vuln_id: V-220764
rule_id: SV-220764r991583_rule
severity: CAT II
title: Windows 10 must be configured to audit Object Access - Other Object Access Events failures.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
[cell repeats an earlier one in this file: 937 characters]

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:

  Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator").

  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following:

  Object Access >> Other Object Access Events - Failure

  If the system does not audit the above, this is a finding.


vuln_id: V-220765
rule_id: SV-220765r991583_rule
severity: CAT II
title: The system must be configured to audit Object Access - Removable Storage failures.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Auditing object access for removable media records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Object Access >> Removable Storage - Failure

  Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.


vuln_id: V-220766
rule_id: SV-220766r991583_rule
severity: CAT II
title: The system must be configured to audit Object Access - Removable Storage successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Auditing object access for removable media records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Object Access >> Removable Storage - Success

  Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.


vuln_id: V-220767
rule_id: SV-220767r991579_rule
severity: CAT II
title: The system must be configured to audit Policy Change - Audit Policy Change successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Policy Change >> Audit Policy Change - Success


vuln_id: V-220768
rule_id: SV-220768r958732_rule
severity: CAT II
title: The system must be configured to audit Policy Change - Authentication Policy Change successes.
cci: CCI-000172,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Authentication Policy Change records events related to changes in authentication policy including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authentication Policy Change" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Policy Change >> Authentication Policy Change - Success


vuln_id: V-220769
rule_id: SV-220769r991579_rule
severity: CAT II
title: The system must be configured to audit Policy Change - Authorization Policy Change successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authorization Policy Change" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 

  Use the AuditPol tool to review the current Audit Policy configuration:
  -Open a Command Prompt with elevated privileges ("Run as Administrator").
  -Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding.

  Policy Change >> Authorization Policy Change - Success


vuln_id: V-220770
rule_id: SV-220770r958732_rule
severity: CAT II
title: The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.
cci: CCI-000172,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Privilege Use >> Sensitive Privilege Use - Failure


vuln_id: V-220771
rule_id: SV-220771r958732_rule
severity: CAT II
title: The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.
cci: CCI-000172,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  Privilege Use >> Sensitive Privilege Use - Success


vuln_id: V-220772
rule_id: SV-220772r991586_rule
severity: CAT II
title: The system must be configured to audit System - IPSec Driver failures.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  IPSec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPSec Driver" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  System >> IPSec Driver - Failure


vuln_id: V-220773
rule_id: SV-220773r991579_rule
severity: CAT II
title: The system must be configured to audit System - Other System Events successes.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  System >> Other System Events - Success


vuln_id: V-220774
rule_id: SV-220774r991579_rule
severity: CAT II
title: The system must be configured to audit System - Other System Events failures.
cci: CCI-000172
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. 

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*"

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  System >> Other System Events - Failure


vuln_id: V-220775
rule_id: SV-220775r958732_rule
severity: CAT II
title: The system must be configured to audit System - Security State Change successes.
cci: CCI-000172,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security State Change" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  System >> Security State Change - Success


vuln_id: V-220776
rule_id: SV-220776r958732_rule
severity: CAT II
title: The system must be configured to audit System - Security System Extension successes.
cci: CCI-000172,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security System Extension" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  System >> Security System Extension - Success


vuln_id: V-220777
rule_id: SV-220777r958732_rule
severity: CAT II
title: The system must be configured to audit System - System Integrity failures.
cci: CCI-000172,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  System >> System Integrity - Failure


vuln_id: V-220778
rule_id: SV-220778r958732_rule
severity: CAT II
title: The system must be configured to audit System - System Integrity successes.
cci: CCI-000172,CCI-002234
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:

  System >> System Integrity - Success


vuln_id: V-220779
rule_id: SV-220779r958752_rule
severity: CAT II
title: The Application event log size must be configured to 32768 KB or greater.
cci: CCI-001849
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.

  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.

check_text:
  If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Path:  \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\

  Value Name:  MaxSize

  Value Type:  REG_DWORD
  Value:  0x00008000 (32768) (or greater)


vuln_id: V-220780
rule_id: SV-220780r958752_rule
severity: CAT II
title: The Security event log size must be configured to 1024000 KB or greater.
cci: CCI-001849
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "1024000" or greater.

  If the system is configured to send audit records directly to an audit server, documented with the ISSO.

check_text:
  If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive: HKEY_LOCAL_MACHINE
  Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\

  Value Name: MaxSize

  Value Type: REG_DWORD
  Value: 0x000fa000 (1024000) (or greater)


vuln_id: V-220781
rule_id: SV-220781r958752_rule
severity: CAT II
title: The System event log size must be configured to 32768 KB or greater.
cci: CCI-001849
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.

  Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.

check_text:
  If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.

  If the following registry value does not exist or is not configured as specified, this is a finding:

  Registry Hive:  HKEY_LOCAL_MACHINE
  Registry Path:  \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\

  Value Name:  MaxSize

  Value Type:  REG_DWORD
  Value:  0x00008000 (32768) (or greater)


vuln_id: V-220782
rule_id: SV-220782r958434_rule
severity: CAT II
cci: CCI-000162,CCI-000163,CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
title:
  Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.

description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.

  Eventlog - Full Control
  SYSTEM - Full Control
  Administrators - Full Control

  The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory.

  If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".

check_text:
  Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.

  Eventlog - Full Control
  SYSTEM - Full Control
  Administrators - Full Control

  The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.

  If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.

  NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.


vuln_id: V-220783
rule_id: SV-220783r958434_rule
severity: CAT II
title: Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.
cci: CCI-000162,CCI-000163,CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access.  The default permissions listed below satisfy this requirement.

  Eventlog - Full Control
  SYSTEM - Full Control
  Administrators - Full Control

  The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory.

  If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".

check_text:
  Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.

  Eventlog - Full Control
  SYSTEM - Full Control
  Administrators - Full Control

  The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.

  If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.

  NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.


vuln_id: V-220784
rule_id: SV-220784r958434_rule
severity: CAT II
title: Windows 10 permissions for the System event log must prevent access by non-privileged accounts.
cci: CCI-000162,CCI-000163,CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.

  Eventlog - Full Control
  SYSTEM - Full Control
  Administrators - Full Control

  The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory.

  If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".

check_text:
  Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.

  Eventlog - Full Control
  SYSTEM - Full Control
  Administrators - Full Control

  The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder.

  If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.

  NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.


vuln_id: V-220786
rule_id: SV-220786r958412_rule
severity: CAT II
title: Windows 10 must be configured to audit Other Policy Change Events Failures.
cci: CCI-000130
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> "Audit Other Policy Change Events" with "Failure" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Policy Change  >> Other Policy Change Events - Failure


vuln_id: V-220787
rule_id: SV-220787r958412_rule
severity: CAT II
title: Windows 10 must be configured to audit other Logon/Logoff Events Successes.
cci: CCI-000130
created_at: 2026-01-14 17:55:45
updated_at: 2026-03-05 13:41:37
description:
  <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

  Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Other Logon/Logoff Events" with "Success" selected.

check_text:
  Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective.

  Use the AuditPol tool to review the current Audit Policy configuration:
  Open a Command Prompt with elevated privileges ("Run as Administrator").
  Enter "AuditPol /get /category:*".

  Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding:

  Logon/Logoff  >> Other Logon/Logoff Events - Success


