USNS MONTFORD POINT - Findings

V-220709 CAT II Alternate operating systems must not be permitted on the sam...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C6A59B3E1EC7BD525C6D9E3ACE97953F29D0D614 ~~~~~ > Windows Boot Loader ------------------- identifier {current} device partition=C: path \windows\system32\winload.efi description Windows 10 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C6A59B3E1EC7BD525C6D9E3ACE97953F29D0D614 ~~~~~ > Windows Boot Loader ------------------- identifier {current} device partition=C: path \windows\system32\winload.efi description Windows 10 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C6A59B3E1EC7BD525C6D9E3ACE97953F29D0D614 ~~~~~ > Windows Boot Loader ------------------- identifier {current} device partition=C: path \windows\system32\winload.efi description Windows 10 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C6A59B3E1EC7BD525C6D9E3ACE97953F29D0D614 ~~~~~ > Windows Boot Loader ------------------- identifier {current} device partition=C: path \windows\system32\winload.efi description Windows 10 Comments

Check Text

Verify the system does not include other operating system installations. Run "Advanced System Settings". Select the "Advanced" tab. Click the "Settings" button in the "Startup and Recovery" section. If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.

Fix Text

Ensure Windows 10 is the only operating system on a device. Remove alternate operating systems.

V-220710 CAT II Non system-created file shares on a system must limit access...

4 assets Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: FE6E08BCA44D55D33AD47289B0481DA21EA7058A ~~~~~ Only system-created shares exist on this system so this requirement is NA. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: FE6E08BCA44D55D33AD47289B0481DA21EA7058A ~~~~~ Only system-created shares exist on this system so this requirement is NA. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: FE6E08BCA44D55D33AD47289B0481DA21EA7058A ~~~~~ Only system-created shares exist on this system so this requirement is NA. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: FE6E08BCA44D55D33AD47289B0481DA21EA7058A ~~~~~ Only system-created shares exist on this system so this requirement is NA. Comments

Check Text

Non system-created shares should not typically exist on workstations. If only system-created shares exist on the system this is NA. Run "Computer Management". Navigate to System Tools >> Shared Folders >> Shares. If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA. (Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.) Right click any non-system-created shares. Select "Properties". Select the "Share Permissions" tab. Verify the necessity of any shares found. If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. Select the "Security" tab. If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.

Fix Text

If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. Remove any unnecessary non-system created shares.

V-220713 CAT II Only accounts responsible for the backup operations must be ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 704F569EEF94798C36B530B55B2AB7E70E1A8BF8 ~~~~~ The local Backup Operators group has no members. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 704F569EEF94798C36B530B55B2AB7E70E1A8BF8 ~~~~~ The local Backup Operators group has no members. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 704F569EEF94798C36B530B55B2AB7E70E1A8BF8 ~~~~~ The local Backup Operators group has no members. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 704F569EEF94798C36B530B55B2AB7E70E1A8BF8 ~~~~~ The local Backup Operators group has no members. Comments

Check Text

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Backup Operators group. If the group contains no accounts, this is not a finding. If the group contains any accounts, the accounts must be specifically for backup functions. If the group contains any standard user accounts used for performing normal user tasks, this is a finding.

Fix Text

Create separate accounts for backup operations for users with this privilege.

V-220714 CAT II Only authorized user accounts must be allowed to create or r...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 5AC5524FFF1F79A06300AD80E1BB81C6CE96823C ~~~~~ The local Hyper-V Administrators group has no members. No 3rd-party hypervisors detected. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 5AC5524FFF1F79A06300AD80E1BB81C6CE96823C ~~~~~ The local Hyper-V Administrators group has no members. No 3rd-party hypervisors detected. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 5AC5524FFF1F79A06300AD80E1BB81C6CE96823C ~~~~~ The local Hyper-V Administrators group has no members. No 3rd-party hypervisors detected. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 5AC5524FFF1F79A06300AD80E1BB81C6CE96823C ~~~~~ The local Hyper-V Administrators group has no members. No 3rd-party hypervisors detected. Comments

Check Text

If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines. For Hyper-V, Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Double click on "Hyper-V Administrators". If any unauthorized groups or user accounts are listed in "Members:", this is a finding. For hosted hypervisors other than Hyper-V, verify only authorized user accounts have access to run the virtual machines. Restrictions may be enforced by access to the physical system, software restriction policies, or access restrictions built in to the application. If any unauthorized groups or user accounts have access to create or run virtual machines, this is a finding. All users authorized to create or run virtual machines must be documented with the ISSM/ISSO. Accounts nested within group accounts must be documented as individual accounts and not the group accounts.

Fix Text

For Hyper-V, remove any unauthorized groups or user accounts from the "Hyper-V Administrators" group. For hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.

V-220717 CAT II Permissions for system files and directories must conform to...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: A714F391E7F3D0766FDF8D585F34F5911DEF154C ~~~~~ Network access: Let Everyone permissions apply to anonymous users is set to Disabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa Value Name: EveryoneIncludesAnonymous Value 0 C:\ --------------------- Default permissions are in place. Current ACL: BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) NT AUTHORITY\Authenticated Users:(AD) Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) --------------------- C:\Program Files --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\Program Files (x86) --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\windows --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: A714F391E7F3D0766FDF8D585F34F5911DEF154C ~~~~~ Network access: Let Everyone permissions apply to anonymous users is set to Disabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa Value Name: EveryoneIncludesAnonymous Value 0 C:\ --------------------- Default permissions are in place. Current ACL: BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) NT AUTHORITY\Authenticated Users:(AD) Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) --------------------- C:\Program Files --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\Program Files (x86) --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\windows --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A714F391E7F3D0766FDF8D585F34F5911DEF154C ~~~~~ Network access: Let Everyone permissions apply to anonymous users is set to Disabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa Value Name: EveryoneIncludesAnonymous Value 0 C:\ --------------------- Default permissions are in place. Current ACL: BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) NT AUTHORITY\Authenticated Users:(AD) Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) --------------------- C:\Program Files --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\Program Files (x86) --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\windows --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A714F391E7F3D0766FDF8D585F34F5911DEF154C ~~~~~ Network access: Let Everyone permissions apply to anonymous users is set to Disabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa Value Name: EveryoneIncludesAnonymous Value 0 C:\ --------------------- Default permissions are in place. Current ACL: BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) NT AUTHORITY\Authenticated Users:(AD) Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) --------------------- C:\Program Files --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\Program Files (x86) --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- C:\windows --------------------- Default permissions are in place. Current ACL: NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) --------------------- Comments

Check Text

The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160). If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding. Verify the default permissions for the sample directories below. Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) Viewing in File Explorer: Select the "Security" tab and then select "Advanced". C:\ Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to Administrators - Full control - This folder, subfolders and files SYSTEM - Full control - This folder, subfolders and files Users - Read & execute - This folder, subfolders and files Authenticated Users - Modify - Subfolders and files only Authenticated Users - Create folders / append data - This folder only \Program Files Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files \Windows Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files Alternately use icacls. Run "CMD" as administrator. Enter "icacls" followed by the directory. icacls c:\ icacls "c:\program files" icacls c:\windows The following results will be displayed as each is entered: c:\ S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176 (S,RD,X,RA) BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) NT AUTHORITY\Authenticated Users:(AD) Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) Successfully processed 1 files; Failed processing 0 files c:\program files NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files c:\windows NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files

Fix Text

Maintain the default file system permissions and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN10-SO-000160).

V-220719 CAT II Simple Network Management Protocol (SNMP) must not be instal...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 057BFFF89AE80F23B6898EEDE6ACB7A2A582F923 ~~~~~ Feature Name: SNMP State: Not an available Windows OS feature File 'C:\windows\System32\SNMP.exe' - Does not exist Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 057BFFF89AE80F23B6898EEDE6ACB7A2A582F923 ~~~~~ Feature Name: SNMP State: Not an available Windows OS feature File 'C:\windows\System32\SNMP.exe' - Does not exist Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 057BFFF89AE80F23B6898EEDE6ACB7A2A582F923 ~~~~~ Feature Name: SNMP State: Not an available Windows OS feature File 'C:\windows\System32\SNMP.exe' - Does not exist Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 057BFFF89AE80F23B6898EEDE6ACB7A2A582F923 ~~~~~ Feature Name: SNMP State: Not an available Windows OS feature File 'C:\windows\System32\SNMP.exe' - Does not exist Comments

Check Text

"SNMP" is not installed by default. Verify it has not been installed. Navigate to the Windows\System32 directory. If the "SNMP" application exists, this is a finding.

Fix Text

Uninstall "Simple Network Management Protocol (SNMP)" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Simple Network Management Protocol (SNMP)".

V-220720 CAT II Simple TCP/IP Services must not be installed on the system.

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3839C93396402C2D1935C0A79A5EA5F84FD89657 ~~~~~ Feature Name: SimpleTCP State: Disabled Service 'simptcp' - Does not exist Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3839C93396402C2D1935C0A79A5EA5F84FD89657 ~~~~~ Feature Name: SimpleTCP State: Disabled Service 'simptcp' - Does not exist Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3839C93396402C2D1935C0A79A5EA5F84FD89657 ~~~~~ Feature Name: SimpleTCP State: Disabled Service 'simptcp' - Does not exist Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3839C93396402C2D1935C0A79A5EA5F84FD89657 ~~~~~ Feature Name: SimpleTCP State: Disabled Service 'simptcp' - Does not exist Comments

Check Text

"Simple TCP/IP Services" is not installed by default. Verify it has not been installed. Run "Services.msc". If "Simple TCP/IP Services" is listed, this is a finding.

Fix Text

Uninstall "Simple TCPIP Services (i.e. echo, daytime etc)" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Simple TCPIP Services (i.e. echo, daytime etc)".

V-220721 CAT II The Telnet Client must not be installed on the system.

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: A81D9B5E938646D417819ED5BF998BADD70640B9 ~~~~~ Feature Name: TelnetClient State: Disabled File 'C:\windows\System32\telnet.exe' - Does not exist Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: A81D9B5E938646D417819ED5BF998BADD70640B9 ~~~~~ Feature Name: TelnetClient State: Disabled File 'C:\windows\System32\telnet.exe' - Does not exist Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A81D9B5E938646D417819ED5BF998BADD70640B9 ~~~~~ Feature Name: TelnetClient State: Disabled File 'C:\windows\System32\telnet.exe' - Does not exist Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A81D9B5E938646D417819ED5BF998BADD70640B9 ~~~~~ Feature Name: TelnetClient State: Disabled File 'C:\windows\System32\telnet.exe' - Does not exist Comments

Check Text

The "Telnet Client" is not installed by default. Verify it has not been installed. Navigate to the Windows\System32 directory. If the "telnet" application exists, this is a finding.

Fix Text

Uninstall "Telnet Client" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Telnet Client".

V-220722 CAT II The TFTP Client must not be installed on the system.

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 1E760C41C9A5B472A534793B2607BA02D749FD4A ~~~~~ Feature Name: TFTP State: Disabled File 'C:\windows\System32\TFTP.exe' - Does not exist Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 1E760C41C9A5B472A534793B2607BA02D749FD4A ~~~~~ Feature Name: TFTP State: Disabled File 'C:\windows\System32\TFTP.exe' - Does not exist Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 1E760C41C9A5B472A534793B2607BA02D749FD4A ~~~~~ Feature Name: TFTP State: Disabled File 'C:\windows\System32\TFTP.exe' - Does not exist Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 1E760C41C9A5B472A534793B2607BA02D749FD4A ~~~~~ Feature Name: TFTP State: Disabled File 'C:\windows\System32\TFTP.exe' - Does not exist Comments

Check Text

The "TFTP Client" is not installed by default. Verify it has not been installed. Navigate to the Windows\System32 directory. If the "TFTP" application exists, this is a finding.

Fix Text

Uninstall "TFTP Client" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "TFTP Client".

V-220723 CAT II Software certificate installation files must be removed from...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6D1B1446FB5CC2634D5EADF74C6B8A5903ECB08C ~~~~~ No .p12 or .pfx certificate files found. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6D1B1446FB5CC2634D5EADF74C6B8A5903ECB08C ~~~~~ No .p12 or .pfx certificate files found. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6D1B1446FB5CC2634D5EADF74C6B8A5903ECB08C ~~~~~ No .p12 or .pfx certificate files found. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6D1B1446FB5CC2634D5EADF74C6B8A5903ECB08C ~~~~~ No .p12 or .pfx certificate files found. Comments

Check Text

Search all drives for *.p12 and *.pfx files. If any files with these extensions exist, this is a finding. This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.

Fix Text

Remove any certificate installation files (*.p12 and *.pfx) found on a system. Note: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files.

V-220724 CAT II A host-based firewall must be installed and enabled on the s...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: A59EC07C23ED1CD5AC3EC4DCA1CDC5AA91AFF2CE ~~~~~ 3rd-Party Firewall detected: ---------------------------- WMI Namespace: ROOT/SecurityCenter2 WMI Class: FirewallProduct Display Name: Trellix Endpoint Security Product State: On Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: A59EC07C23ED1CD5AC3EC4DCA1CDC5AA91AFF2CE ~~~~~ 3rd-Party Firewall detected: ---------------------------- WMI Namespace: ROOT/SecurityCenter2 WMI Class: FirewallProduct Display Name: Trellix Endpoint Security Product State: On Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be OPEN on 10/23/2025 ResultHash: 42EA5C27D5483DD6040559A5A9C913E4303B2B82 ~~~~~ 3rd-Party Firewall detected: ---------------------------- WMI Namespace: ROOT/SecurityCenter2 WMI Class: FirewallProduct Display Name: Trellix Endpoint Security Product State: Off No 3rd-Party firewall has been found to be enabled. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be OPEN on 10/23/2025 ResultHash: 42EA5C27D5483DD6040559A5A9C913E4303B2B82 ~~~~~ 3rd-Party Firewall detected: ---------------------------- WMI Namespace: ROOT/SecurityCenter2 WMI Class: FirewallProduct Display Name: Trellix Endpoint Security Product State: Off No 3rd-Party firewall has been found to be enabled. Comments

Check Text

Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. The configuration requirements will be determined by the applicable firewall STIG.

Fix Text

Install and enable a host-based firewall on the system.

V-220725 CAT II Inbound exceptions to the firewall on Windows 10 domain work...

4 assets 3 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details No details recorded. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details No details recorded. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details No details recorded. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details No details recorded. Comments

Check Text

Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts. If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding. Review inbound firewall exceptions. Computer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane) For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles. If a third-party firewall is used, ensure comparable settings are in place.

Fix Text

Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts. Configure only inbound connection exceptions for authorized remote management hosts. Computer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane) For any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles. If a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.

V-220728 CAT II The Windows PowerShell 2.0 feature must be disabled on the s...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: EF2E777D19D164429E77EB2DEECD9B140F75712C ~~~~~ Feature Name: MicrosoftWindowsPowerShellV2 State: Disabled Feature Name: MicrosoftWindowsPowerShellV2Root State: Disabled Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: EF2E777D19D164429E77EB2DEECD9B140F75712C ~~~~~ Feature Name: MicrosoftWindowsPowerShellV2 State: Disabled Feature Name: MicrosoftWindowsPowerShellV2Root State: Disabled Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: EF2E777D19D164429E77EB2DEECD9B140F75712C ~~~~~ Feature Name: MicrosoftWindowsPowerShellV2 State: Disabled Feature Name: MicrosoftWindowsPowerShellV2Root State: Disabled Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: EF2E777D19D164429E77EB2DEECD9B140F75712C ~~~~~ Feature Name: MicrosoftWindowsPowerShellV2 State: Disabled Feature Name: MicrosoftWindowsPowerShellV2Root State: Disabled Comments

Check Text

Run "Windows PowerShell" with elevated privileges (run as administrator). Enter the following: Get-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShellv2* If either of the following have a "State" of "Enabled", this is a finding. FeatureName : MicrosoftWindowsPowerShellV2 State : Enabled FeatureName : MicrosoftWindowsPowerShellV2Root State : Enabled Alternately: Search for "Features". Select "Turn Windows features on or off". If "Windows PowerShell 2.0" (whether the subcategory of "Windows PowerShell 2.0 Engine" is selected or not) is selected, this is a finding.

Fix Text

Disable "Windows PowerShell 2.0" on the system. Run "Windows PowerShell" with elevated privileges (run as administrator). Enter the following: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root This command should disable both "MicrosoftWindowsPowerShellV2Root" and "MicrosoftWindowsPowerShellV2" which correspond to "Windows PowerShell 2.0" and "Windows PowerShell 2.0 Engine" respectively in "Turn Windows features on or off". Alternately: Search for "Features". Select "Turn Windows features on or off". De-select "Windows PowerShell 2.0".

V-220729 CAT II The Server Message Block (SMB) v1 protocol must be disabled ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C3D9F8A0D5CD58710869EE3531168EDEC3A52D96 ~~~~~ The Windows Feature 'SMB1Protocol' is Disabled Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C3D9F8A0D5CD58710869EE3531168EDEC3A52D96 ~~~~~ The Windows Feature 'SMB1Protocol' is Disabled Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C3D9F8A0D5CD58710869EE3531168EDEC3A52D96 ~~~~~ The Windows Feature 'SMB1Protocol' is Disabled Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C3D9F8A0D5CD58710869EE3531168EDEC3A52D96 ~~~~~ The Windows Feature 'SMB1Protocol' is Disabled Comments

Check Text

Different methods are available to disable SMBv1 on Windows 10. This is the preferred method, however if V-220730 and V-220731 are configured, this is NA. Run "Windows PowerShell" with elevated privileges (run as administrator). Enter the following: Get-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol If "State : Enabled" is returned, this is a finding. Alternately: Search for "Features". Select "Turn Windows features on or off". If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding.

Fix Text

Disable the SMBv1 protocol. Run "Windows PowerShell" with elevated privileges (run as administrator). Enter the following: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol Alternately: Search for "Features". Select "Turn Windows features on or off". De-select "SMB 1.0/CIFS File Sharing Support".

V-220730 CAT II The Server Message Block (SMB) v1 protocol must be disabled ...

4 assets Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments

Check Text

Different methods are available to disable SMBv1 on Windows 10, if V-220729 is configured, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ Value Name: SMB1 Type: REG_DWORD Value: 0x00000000 (0)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. The system must be restarted for the change to take effect.

V-220731 CAT II The Server Message Block (SMB) v1 protocol must be disabled ...

4 assets Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 7F4B25627DA8CBF9E487087648DD919E3D09FB08 ~~~~~ V-220729 is configured so this requirement is NA. Comments

Check Text

Different methods are available to disable SMBv1 on Windows 10, if V-220729 is configured, this is NA. If the following registry value is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ Value Name: Start Type: REG_DWORD Value: 0x00000004 (4)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. The system must be restarted for the changes to take effect.

V-220732 CAT II The Secondary Logon service must be disabled on Windows 10.

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: F1E9FF02EC916A0AB65DEC2E186472333B1367D3 ~~~~~ Secondary Logon service is Disabled and Stopped Name: seclogon DisplayName: Secondary Logon StartType: Disabled Status: Stopped Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: F1E9FF02EC916A0AB65DEC2E186472333B1367D3 ~~~~~ Secondary Logon service is Disabled and Stopped Name: seclogon DisplayName: Secondary Logon StartType: Disabled Status: Stopped Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: F1E9FF02EC916A0AB65DEC2E186472333B1367D3 ~~~~~ Secondary Logon service is Disabled and Stopped Name: seclogon DisplayName: Secondary Logon StartType: Disabled Status: Stopped Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: F1E9FF02EC916A0AB65DEC2E186472333B1367D3 ~~~~~ Secondary Logon service is Disabled and Stopped Name: seclogon DisplayName: Secondary Logon StartType: Disabled Status: Stopped Comments

Check Text

Run "Services.msc". Locate the "Secondary Logon" service. If the "Startup Type" is not "Disabled" or the "Status" is "Running", this is a finding.

Fix Text

Configure the "Secondary Logon" service "Startup Type" to "Disabled".

V-220733 CAT II Orphaned security identifiers (SIDs) must be removed from us...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 31FA001D95F799B1779974DAE788547F7248BA04 ~~~~~ No unresolved SIDs are assigned any User Right Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 31FA001D95F799B1779974DAE788547F7248BA04 ~~~~~ No unresolved SIDs are assigned any User Right Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 31FA001D95F799B1779974DAE788547F7248BA04 ~~~~~ No unresolved SIDs are assigned any User Right Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 31FA001D95F799B1779974DAE788547F7248BA04 ~~~~~ No unresolved SIDs are assigned any User Right Comments

Check Text

Review the effective User Rights setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.

Fix Text

Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.

V-220734 CAT II Bluetooth must be turned off unless approved by the organiza...

4 assets Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments

Check Text

This is NA if the system does not have Bluetooth. Verify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\PolicyManager\current\device\Connectivity\ Value Name: AllowBluetooth Value Type: REG_DWORD Value: 0x00000000 (0) Approval must be documented with the ISSO.

Fix Text

Turn off Bluetooth radios not organizationally approved. For systems managed by Intune, apply the DOD Windows 10 STIG Settings Catalog (or equivalent Intune policy) found in the Intune policy package available on cyber.mil. Steps to create an Intune policy: 1. Sign in to the Intune admin center >> Devices >> Configuration >> Create >> New Policy. 2. Platform: Windows 10 and later. Profile type: Settings Catalog, then click "Create". 3. Basics: Provide a Name and Description of the profile, then click "Next". 4. Configuration settings: Click "+ Add settings" and search for connectivity under the Settings picker. Under the Connectivity category, check the box next to Allow Bluetooth setting. Choose the first option, Disallow Bluetooth, then click "Next". 5. Scope tags: (optional), then click "Next". 6. Assignments: Assign the policy to Entra security groups that contain the target users or devices, then click "Next". 7. Review + create: Review the deployment summary, then click "Create".

V-220736 CAT II The system must notify the user when a Bluetooth device atte...

4 assets Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 39551D4D0AF79B59E75A7C1C89B3FFD9CFD2900C ~~~~~ Get-PnpDevice did not return any Bluetooth devices so this requirement is NA. Comments

Check Text

This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy. Search for "Bluetooth". View Bluetooth Settings. Select "More Bluetooth Options" If "Alert me when a new Bluetooth device wants to connect" is not checked, this is a finding.

Fix Text

Configure Bluetooth to notify users if devices attempt to connect. View Bluetooth Settings. Ensure "Alert me when a new Bluetooth device wants to connect" is checked.

V-220738 CAT II Windows 10 nonpersistent VM sessions must not exceed 24 hour...

4 assets Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 7822FD999CD1269C212FC5A2E800DEABA17877EB ~~~~~ System is not virtual so this requirement is NA. Manufacturer: HP Model: HP Z1 Entry Tower G5 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 12/17/2025 ResultHash: 7822FD999CD1269C212FC5A2E800DEABA17877EB ~~~~~ System is not virtual so this requirement is NA. Manufacturer: HP Model: HP Z1 Entry Tower G5 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 1704E06411BF37EE4D58AB3BAF279A6FEEAFEA02 ~~~~~ System is not virtual so this requirement is NA. Manufacturer: HP Model: HP ProDesk 600 G6 Microtower PC Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 1704E06411BF37EE4D58AB3BAF279A6FEEAFEA02 ~~~~~ System is not virtual so this requirement is NA. Manufacturer: HP Model: HP ProDesk 600 G6 Microtower PC Comments

Check Text

Ensure there is a documented policy or procedure in place that nonpersistent VM sessions do not exceed 24 hours. If the system is NOT a nonpersistent VM, this is Not Applicable. If no such documented policy or procedure is in place, this is a finding.

Fix Text

Set nonpersistent VM sessions to not exceed 24 hours.

V-220739 CAT II Windows 10 account lockout duration must be configured to 15...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 45DDCAF75C302AFBAF4F0083BDF37443F28A83CC ~~~~~ 'Reset account lockout counter after' is Configured LockoutDuration: 15 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 45DDCAF75C302AFBAF4F0083BDF37443F28A83CC ~~~~~ 'Reset account lockout counter after' is Configured LockoutDuration: 15 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 45DDCAF75C302AFBAF4F0083BDF37443F28A83CC ~~~~~ 'Reset account lockout counter after' is Configured LockoutDuration: 15 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 45DDCAF75C302AFBAF4F0083BDF37443F28A83CC ~~~~~ 'Reset account lockout counter after' is Configured LockoutDuration: 15 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. A value of "0" is also acceptable, requiring an administrator to unlock the account.

V-220740 CAT II The number of allowed bad logon attempts must be configured ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 41AA04D471372F76F2904EE0EF5CA66462310C29 ~~~~~ 'Account lockout threshold' is Configured LockoutBadCount: 3 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 41AA04D471372F76F2904EE0EF5CA66462310C29 ~~~~~ 'Account lockout threshold' is Configured LockoutBadCount: 3 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 41AA04D471372F76F2904EE0EF5CA66462310C29 ~~~~~ 'Account lockout threshold' is Configured LockoutBadCount: 3 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 41AA04D471372F76F2904EE0EF5CA66462310C29 ~~~~~ 'Account lockout threshold' is Configured LockoutBadCount: 3 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0" which is unacceptable).

V-220741 CAT II The period of time before the bad logon counter is reset mus...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C7A0EE0ADBB8B8A24BDEA6EC108E7DA83CCEAB1C ~~~~~ 'Reset account lockout counter after' is Configured ResetLockoutCount: 15 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C7A0EE0ADBB8B8A24BDEA6EC108E7DA83CCEAB1C ~~~~~ 'Reset account lockout counter after' is Configured ResetLockoutCount: 15 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7A0EE0ADBB8B8A24BDEA6EC108E7DA83CCEAB1C ~~~~~ 'Reset account lockout counter after' is Configured ResetLockoutCount: 15 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7A0EE0ADBB8B8A24BDEA6EC108E7DA83CCEAB1C ~~~~~ 'Reset account lockout counter after' is Configured ResetLockoutCount: 15 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to "15" minutes.

V-220742 CAT II The password history must be configured to 24 passwords reme...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3D66E73980452DD8BD3CA8FE1C7ACB35BFFBF1E0 ~~~~~ 'Enforce password history' is Configured PasswordHistorySize: 24 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3D66E73980452DD8BD3CA8FE1C7ACB35BFFBF1E0 ~~~~~ 'Enforce password history' is Configured PasswordHistorySize: 24 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3D66E73980452DD8BD3CA8FE1C7ACB35BFFBF1E0 ~~~~~ 'Enforce password history' is Configured PasswordHistorySize: 24 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3D66E73980452DD8BD3CA8FE1C7ACB35BFFBF1E0 ~~~~~ 'Enforce password history' is Configured PasswordHistorySize: 24 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.

V-220743 CAT II The maximum password age must be configured to 60 days or le...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DCF0D84A66291D6B08E64E7CDECB346B977B8E44 ~~~~~ 'Maximum Password Age' is Configured MaximumPasswordAge: 60 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DCF0D84A66291D6B08E64E7CDECB346B977B8E44 ~~~~~ 'Maximum Password Age' is Configured MaximumPasswordAge: 60 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DCF0D84A66291D6B08E64E7CDECB346B977B8E44 ~~~~~ 'Maximum Password Age' is Configured MaximumPasswordAge: 60 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DCF0D84A66291D6B08E64E7CDECB346B977B8E44 ~~~~~ 'Maximum Password Age' is Configured MaximumPasswordAge: 60 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum Password Age" to "60" days or less (excluding "0" which is unacceptable).

V-220744 CAT II The minimum password age must be configured to at least 1 da...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C0EA9DC4F33916CB6458AECF6144EA38763BD20B ~~~~~ 'Minimum Password Age' is Configured MinimumPasswordAge: 1 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: C0EA9DC4F33916CB6458AECF6144EA38763BD20B ~~~~~ 'Minimum Password Age' is Configured MinimumPasswordAge: 1 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C0EA9DC4F33916CB6458AECF6144EA38763BD20B ~~~~~ 'Minimum Password Age' is Configured MinimumPasswordAge: 1 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C0EA9DC4F33916CB6458AECF6144EA38763BD20B ~~~~~ 'Minimum Password Age' is Configured MinimumPasswordAge: 1 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Minimum password age" is less than "1" day, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum Password Age" to at least "1" day.

V-220745 CAT II Passwords must, at a minimum, be 14 characters.

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6BE08ACAB8AD3365003019D2702FDF3075E0F32E ~~~~~ 'Minimum password length' is Configured MinimumPasswordLength: 14 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6BE08ACAB8AD3365003019D2702FDF3075E0F32E ~~~~~ 'Minimum password length' is Configured MinimumPasswordLength: 14 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6BE08ACAB8AD3365003019D2702FDF3075E0F32E ~~~~~ 'Minimum password length' is Configured MinimumPasswordLength: 14 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6BE08ACAB8AD3365003019D2702FDF3075E0F32E ~~~~~ 'Minimum password length' is Configured MinimumPasswordLength: 14 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Minimum password length," is less than "14" characters, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length" to "14" characters.

V-220746 CAT II The built-in Microsoft password complexity filter must be en...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 26F570536C8CEA59E2945B3739F44E08FA2096F8 ~~~~~ 'Password must meet complexity requirements' is Configured PasswordComplexity: 1 Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 26F570536C8CEA59E2945B3739F44E08FA2096F8 ~~~~~ 'Password must meet complexity requirements' is Configured PasswordComplexity: 1 Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 26F570536C8CEA59E2945B3739F44E08FA2096F8 ~~~~~ 'Password must meet complexity requirements' is Configured PasswordComplexity: 1 Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 26F570536C8CEA59E2945B3739F44E08FA2096F8 ~~~~~ 'Password must meet complexity requirements' is Configured PasswordComplexity: 1 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. If the site is using a password filter that requires this setting be set to "Disabled" for the filter to be used, this would not be considered a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".

V-220748 CAT II The system must be configured to audit Account Logon - Crede...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Logon >> Credential Validation - Failure

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Failure" selected.

V-220749 CAT II The system must be configured to audit Account Logon - Crede...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DA7DF341CB41A0B60FB92B392D3AA616EB0F8C60 ~~~~~ Credential Validation: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Logon >> Credential Validation - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Success" selected.

V-220750 CAT II The system must be configured to audit Account Management - ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: E026B0CB713D941C6AC9CDB0976AD1DDCB8564DE ~~~~~ Security Group Management: Success Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: E026B0CB713D941C6AC9CDB0976AD1DDCB8564DE ~~~~~ Security Group Management: Success Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E026B0CB713D941C6AC9CDB0976AD1DDCB8564DE ~~~~~ Security Group Management: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E026B0CB713D941C6AC9CDB0976AD1DDCB8564DE ~~~~~ Security Group Management: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> Security Group Management - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Success" selected.

V-220751 CAT II The system must be configured to audit Account Management - ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> User Account Management - Failure

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Failure" selected.

V-220752 CAT II The system must be configured to audit Account Management - ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3AA7E01468B70DEFA406DABDAF58FAD0F1E7BE63 ~~~~~ User Account Management: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> User Account Management - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Success" selected.

V-220753 CAT II The system must be configured to audit Detailed Tracking - P...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DCA308C4975262F51F29DAED106C291E8960644D ~~~~~ Plug and Play Events: Success Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: DCA308C4975262F51F29DAED106C291E8960644D ~~~~~ Plug and Play Events: Success Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DCA308C4975262F51F29DAED106C291E8960644D ~~~~~ Plug and Play Events: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DCA308C4975262F51F29DAED106C291E8960644D ~~~~~ Plug and Play Events: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Detailed Tracking >> Plug and Play Events - Success

Fix Text

Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit PNP Activity" with "Success" selected.

V-220754 CAT II The system must be configured to audit Detailed Tracking - P...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 0AE8978EA0ED5EC0DA9005C2608D05E3ED51FF0C ~~~~~ Process Creation: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 0AE8978EA0ED5EC0DA9005C2608D05E3ED51FF0C ~~~~~ Process Creation: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 812B92C97F6B9D7E16F6294B301DF81AC57720AA ~~~~~ Process Creation: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 812B92C97F6B9D7E16F6294B301DF81AC57720AA ~~~~~ Process Creation: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Detailed Tracking >> Process Creation - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit Process Creation" with "Success" selected.

V-220755 CAT II The system must be configured to audit Logon/Logoff - Accoun...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 93A0853E44773D10564D3ED14795A30CC6191C41 ~~~~~ Account Lockout: Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 93A0853E44773D10564D3ED14795A30CC6191C41 ~~~~~ Account Lockout: Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 93A0853E44773D10564D3ED14795A30CC6191C41 ~~~~~ Account Lockout: Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 93A0853E44773D10564D3ED14795A30CC6191C41 ~~~~~ Account Lockout: Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Account Lockout - Failure

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.

V-220756 CAT II The system must be configured to audit Logon/Logoff - Group ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6318D6520C67CFD4EB30011DEB0BCAC76DCB6CC8 ~~~~~ Group Membership: Success Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6318D6520C67CFD4EB30011DEB0BCAC76DCB6CC8 ~~~~~ Group Membership: Success Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6318D6520C67CFD4EB30011DEB0BCAC76DCB6CC8 ~~~~~ Group Membership: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6318D6520C67CFD4EB30011DEB0BCAC76DCB6CC8 ~~~~~ Group Membership: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Group Membership - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Group Membership" with "Success" selected.

V-220757 CAT II The system must be configured to audit Logon/Logoff - Logoff...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 7A950E7532BE5A2E4F09E8A1E67C0FDAF4E8851D ~~~~~ Logoff: Success Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 7A950E7532BE5A2E4F09E8A1E67C0FDAF4E8851D ~~~~~ Logoff: Success Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7A950E7532BE5A2E4F09E8A1E67C0FDAF4E8851D ~~~~~ Logoff: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7A950E7532BE5A2E4F09E8A1E67C0FDAF4E8851D ~~~~~ Logoff: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logoff - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logoff" with "Success" selected.

V-220758 CAT II The system must be configured to audit Logon/Logoff - Logon ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logon - Failure

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Failure" selected.

V-220759 CAT II The system must be configured to audit Logon/Logoff - Logon ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 6557C8974FEC4237F5E900001DCA960F93582900 ~~~~~ Logon: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logon - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Success" selected.

V-220760 CAT II The system must be configured to audit Logon/Logoff - Specia...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: BA41DFC702C29EE8A4A2E9FCA6F596F4BCEB5161 ~~~~~ Special Logon: Success Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: BA41DFC702C29EE8A4A2E9FCA6F596F4BCEB5161 ~~~~~ Special Logon: Success Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: BA41DFC702C29EE8A4A2E9FCA6F596F4BCEB5161 ~~~~~ Special Logon: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: BA41DFC702C29EE8A4A2E9FCA6F596F4BCEB5161 ~~~~~ Special Logon: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Special Logon - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Special Logon" with "Success" selected.

V-220761 CAT II Windows 10 must be configured to audit Object Access - File ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following: Object Access >> File Share - Failure If the system does not audit the above, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit File Share" with "Failure" selected.

V-220762 CAT II Windows 10 must be configured to audit Object Access - File ...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0455215FA05B68D7636085140D0F6948977838FA ~~~~~ File Share: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following: Object Access >> File Share - Success If the system does not audit the above, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit File Share" with "Success" selected.

V-220763 CAT II Windows 10 must be configured to audit Object Access - Other...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following: Object Access >> Other Object Access Events - Success If the system does not audit the above, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Success" selected.

V-220764 CAT II Windows 10 must be configured to audit Object Access - Other...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 11B3505989ED9CB1A87C28ADEB0006351D13AF0E ~~~~~ Other Object Access Events: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following: Object Access >> Other Object Access Events - Failure If the system does not audit the above, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Failure" selected.

V-220765 CAT II The system must be configured to audit Object Access - Remov...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Object Access >> Removable Storage - Failure Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.

V-220766 CAT II The system must be configured to audit Object Access - Remov...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 2407B24433D2B954716743C3A3B170CD2F14F60B ~~~~~ Removable Storage: Success and Failure Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Object Access >> Removable Storage - Success Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.

V-220767 CAT II The system must be configured to audit Policy Change - Audit...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: D7671610543864B4122F2BC729D6BEF505693247 ~~~~~ Audit Policy Change: Success Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: D7671610543864B4122F2BC729D6BEF505693247 ~~~~~ Audit Policy Change: Success Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: D7671610543864B4122F2BC729D6BEF505693247 ~~~~~ Audit Policy Change: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: D7671610543864B4122F2BC729D6BEF505693247 ~~~~~ Audit Policy Change: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Policy Change >> Audit Policy Change - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Success" selected.

V-220768 CAT II The system must be configured to audit Policy Change - Authe...

4 assets 4 Closed Microsoft Windows 10...

Hostname	IP Address	Last Scan
MONT-SW-89108	22.19.120.22	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 74E73B7E4CAE038B8D1A0EEE0B6B63A38790EF6E ~~~~~ Authentication Policy Change: Success Comments
MONT-SW-89134	22.19.120.21	2026-03-04
Finding Details Evaluate-STIG 1.2510.0 (Scan-Windows10_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 74E73B7E4CAE038B8D1A0EEE0B6B63A38790EF6E ~~~~~ Authentication Policy Change: Success Comments
MONT-WS-92010	164.231.187.45	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 74E73B7E4CAE038B8D1A0EEE0B6B63A38790EF6E ~~~~~ Authentication Policy Change: Success Comments
MONT-WS-92040	164.231.187.72	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 74E73B7E4CAE038B8D1A0EEE0B6B63A38790EF6E ~~~~~ Authentication Policy Change: Success Comments

Check Text

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Policy Change >> Authentication Policy Change - Success

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authentication Policy Change" with "Success" selected.

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text