USNS MONTFORD POINT - Findings

V-224821 CAT I Administrative accounts must not be used with applications t...

8 assets 8 Open Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. If it does not, this is a finding. The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement.

Fix Text

Establish a policy, at minimum, to prohibit administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Ensure the policy is enforced. The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement.

V-224819 CAT I Users with Administrative privileges must have separate acco...

8 assets 7 Open 1 Closed Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding.

Fix Text

Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties.

V-225007 CAT I Only administrators responsible for the member server or sta...

8 assets 3 Open 4 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: DC46B573621F6ECBBEBFC3EAC3FFB498356150AF ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONT-AP-002\DOD_Admin objectClass: User objectSID: S-1-5-21-3515710802-3801378020-2101878990-1000 Name: MONT-AP-002\X_Admin objectClass: User objectSID: S-1-5-21-3515710802-3801378020-2101878990-500 Name: MONTFORD-POINT\Server Administrator Group objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1109 Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 04D272EFF579CBFBB029CA64C75D595999410214 ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONT-BE-002\DOD_Admin objectClass: User objectSID: S-1-5-21-2559903909-3818771750-2130456036-1000 Name: MONT-BE-002\X_Admin objectClass: User objectSID: S-1-5-21-2559903909-3818771750-2130456036-500 Name: MONTFORD-POINT\Server Administrator Group objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1109 Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 3079F2CB216B05B092D336E25D350B864AFC05D2 ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONT-DB-002\DOD_Admin objectClass: User objectSID: S-1-5-21-3489894170-526094123-3548415114-1000 Name: MONT-DB-002\X_Admin objectClass: User objectSID: S-1-5-21-3489894170-526094123-3548415114-500 Name: MONTFORD-POINT\Server Administrator Group objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1109 Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: C0F3904C423975C11B19B4BFBF943881A50CAA13 ~~~~~ System is a 'Primary Domain Controller' so this requirement is NA. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 26130FDD7AA4586B373FC80745ACC1E59F170514 ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONT-DP-001\DOD_Admin objectClass: User objectSID: S-1-5-21-388225469-2825430915-2362864043-1000 Name: MONT-DP-001\X_Admin objectClass: User objectSID: S-1-5-21-388225469-2825430915-2362864043-500 Name: MONTFORD-POINT\Server Administrator Group objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1109 Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 195D3A4C9E0C1244F68BAB51B457A6CB3424C6A3 ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONTFORD-POINT\Domain Admins objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-512 Name: MONTFORD-POINT\Exchange Trusted Subsystem objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1134 Name: MONTFORD-POINT\Organization Management objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1119 Name: MONT-MB-002\DOD_Admin objectClass: User objectSID: S-1-5-21-3803552116-1809661109-1744339665-1000 Name: MONT-MB-002\SHB_Admin objectClass: User objectSID: S-1-5-21-3803552116-1809661109-1744339665-500 Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: E6DF78787BB4DA1415D3FA7445592C5F0EF90842 ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONTFORD-POINT\D.Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1104 Name: MONTFORD-POINT\Server Administrator Group objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1109 Name: MONT-VSF-003\dod_admin objectClass: User objectSID: S-1-5-21-4236012249-4164713760-2408648245-1000 Name: MONT-VSF-003\X_Admin objectClass: User objectSID: S-1-5-21-4236012249-4164713760-2408648245-500 Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 05C0319BF2208BE823FDDFBAF79265AC39289D00 ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONTFORD-POINT\D.Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1104 Name: MONTFORD-POINT\Server Administrator Group objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1109 Name: MONT-VSF-004\dod_admin objectClass: User objectSID: S-1-5-21-2502410760-3344595884-382061215-1000 Name: MONT-VSF-004\X_Admin objectClass: User objectSID: S-1-5-21-2502410760-3344595884-382061215-500 Comments

Check Text

This applies to member servers and standalone or nondomain-joined systems. A separate version applies to domain controllers. Open "Computer Management". Navigate to "Groups" under "Local Users and Groups". Review the local "Administrators" group. Only administrator groups or accounts responsible for administration of the system may be members of the group. For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. Standard user accounts must not be members of the local Administrator group. If accounts that do not have responsibility for administration of the system are members of the local Administrators group, this is a finding. If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.

Fix Text

Configure the local "Administrators" group to include only administrator groups or accounts responsible for administration of the system. For domain-joined member servers, replace the Domain Admins group with a domain member server administrator group. Remove any standard user accounts.

V-224993 CAT I PKI certificates associated with user accounts must be issue...

8 assets 1 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 3D3B4BF9D172F1653F4CA64457844979FAECE364 ~~~~~ Trusted Suffix: MONTFORD-POINT.navy.mil DC Cert Subject: CN=MONT-DC-003.MONTFORD-POINT.navy.mil, OU=USN, OU=PKI, OU=DoD, O=U.S. Government, C=US DC Cert Issuer: CN=DOD SW CA-67, OU=PKI, OU=DoD, O=U.S. Government, C=US DC Cert Thumbprint: 09D2721B5061A5BD0B8E3C771D94CCF915BA291C Trusted Suffix: mil DC Cert Subject: Well Known UPN suffix DC Cert Issuer: Well Known UPN suffix DC Cert Thumbprint: Well Known UPN suffix There are 7 account findings: ------------------------------------- Name: SHB_Admin Enabled: True UPN: DN: CN=SHB_Admin,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil Name: S.Admin Enabled: True UPN: DN: CN=S.Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: N.Admin Enabled: True UPN: DN: CN=N.Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONT-EM-NAA Enabled: True UPN: DN: CN=MONT-EM-NAA,OU=SERVICE ACCOUNTS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONT-EM-SVRCP Enabled: True UPN: DN: CN=MONT-EM-SVRCP,OU=SERVICE ACCOUNTS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONT-EM-WKSCP Enabled: True UPN: DN: CN=MONT-EM-WKSCP,OU=SERVICE ACCOUNTS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONT-EM-Admin Enabled: True UPN: DN: CN=MONT-EM-Admin,OU=SERVICE ACCOUNTS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Review user account mappings to PKI certificates. Open "Windows PowerShell". Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled". Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding. For standard NIPRNet certificates the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI). Alt Tokens and other certificates may use a different UPN format than the EDI-PI which vary by organization. Verified these with the organization. NIPRNet Example: Name - User Principal Name User1 - 1234567890@mil See PKE documentation for other network domain suffixes. If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding.

Fix Text

Map user accounts to PKI certificates using the appropriate User Principal Name (UPN) for the network. See PKE documentation for details.

V-225012 CAT I Windows Server 2016 must be running Credential Guard on doma...

8 assets 1 Open 6 Closed Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 83848C949BBF8A4E2EBDBB4A433926F0E07188E0 ~~~~~ SecurityServicesRunning: 1 Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 83848C949BBF8A4E2EBDBB4A433926F0E07188E0 ~~~~~ SecurityServicesRunning: 1 Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 83848C949BBF8A4E2EBDBB4A433926F0E07188E0 ~~~~~ SecurityServicesRunning: 1 Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: C0F3904C423975C11B19B4BFBF943881A50CAA13 ~~~~~ System is a 'Primary Domain Controller' so this requirement is NA. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 83848C949BBF8A4E2EBDBB4A433926F0E07188E0 ~~~~~ SecurityServicesRunning: 1 Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: E80A78FBEDDA324884CAAB1E479460FD319F84B4 ~~~~~ SecurityServicesRunning: 0 Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 83848C949BBF8A4E2EBDBB4A433926F0E07188E0 ~~~~~ SecurityServicesRunning: 1 Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 83848C949BBF8A4E2EBDBB4A433926F0E07188E0 ~~~~~ SecurityServicesRunning: 1 Comments

Check Text

For domain controllers and standalone or nondomain-joined systems, this is NA. Open "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. Alternately: Run "System Information". Under "System Summary", verify the following: If "Device Guard Security Services Running" does not list "Credential Guard", this is a finding. The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ Value Name: LsaCfgFlags Value Type: REG_DWORD Value: 0x00000001 (1) (Enabled with UEFI lock) A Microsoft article on Credential Guard system requirement can be found at the following link: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration". A Microsoft article on Credential Guard system requirement can be found at the following link: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements Severity Override Guidance: The AO can allow the severity override if they have reviewed the overall protection provided to the affected servers that are not capable of complying with the Credential Guard requirement. Items that should be reviewed/considered for compliance or mitigation for non-Credential Guard compliance are: The use of Microsoft Local Administrator Password Solution (LAPS) or similar products to control different local administrative passwords for all affected affected servers. This is to include a strict password change requirement (60 days or less). …. Strict separation of roles and duties. Server administrator credentials cannot be used on Windows 10 desktop to administer it. Documentation of all exceptions should be supplied. …. Use of a Privileged Access Workstation (PAW) and adherence to the Clean Source principle for administering affected affected servers. …. Boundary Protection that is currently in place to protect from vulnerabilities in the network/servers. …. Windows Defender rule block credential stealing from LSASS.exe is applied. This rule can only be applied if Windows Defender is in use. …. The overall number of vulnerabilities that are unmitigated on the network/servers.

V-271430 CAT I Windows Server 2016 must be configured for name-based strong...

8 assets 1 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 6BC616B0CF84131BFB017A9DC62E207CE8D4CF40 ~~~~~ Server is a 'Primary Domain Controller' This requirement is a permanent finding for server 2016 domain controllers per DOD CIO Memo Upgrading of MS Domain Controller OS to MS Server 2019 or Later (CIO000911-23) Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This requirement is not applicable for Member Servers. Note: This requirement is a permanent finding for server 2016 domain controllers per DOD CIO Memo Upgrading of MS Domain Controller OS to MS Server 2019 or Later (CIO000911-23). If the server is acting as a domain controller, this is a finding.

Fix Text

For servers acting as a domain controller, upgrade the operating system to Microsoft Server 2019 or greater.

V-224828 CAT I Systems must be maintained at a supported servicing level.

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B6AC25614EB7418F4A5ED5C1A135A4467FB661C5 ~~~~~ Operating system is 'Windows Server 2016 Standard 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B6AC25614EB7418F4A5ED5C1A135A4467FB661C5 ~~~~~ Operating system is 'Windows Server 2016 Standard 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B6AC25614EB7418F4A5ED5C1A135A4467FB661C5 ~~~~~ Operating system is 'Windows Server 2016 Standard 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B6AC25614EB7418F4A5ED5C1A135A4467FB661C5 ~~~~~ Operating system is 'Windows Server 2016 Standard 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B6AC25614EB7418F4A5ED5C1A135A4467FB661C5 ~~~~~ Operating system is 'Windows Server 2016 Standard 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B6AC25614EB7418F4A5ED5C1A135A4467FB661C5 ~~~~~ Operating system is 'Windows Server 2016 Standard 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7BEF854B89F42EC500A0B759D80C9F3FAE4D1E65 ~~~~~ Operating system is 'Windows Server 2016 Datacenter 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7BEF854B89F42EC500A0B759D80C9F3FAE4D1E65 ~~~~~ Operating system is 'Windows Server 2016 Datacenter 1607' (10.0.14393) End of Support Date: Jan 12, 2027 End of Support Link: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 Comments

Check Text

This STIG is sunset and no longer maintained. Open "Command Prompt". Enter "winver.exe". If the "About Windows" dialog box displays "Microsoft Windows Server Version 1607 (Build 14393.xxx)" and there is not documented extended support for Microsoft Windows Server 2016, this is a finding.

Fix Text

Upgrade the operating system to a supported version.

V-224829 CAT I The Windows Server 2016 system must use an anti-virus progra...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 265FFF3B14F0922A007BF8136F3FA18973CFB244 ~~~~~ Windows Defender Antivirus is NOT installed. Feature: Windows-Defender State: Disabled Comments

Check Text

Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. If there is no anti-virus solution installed on the system, this is a finding. Verify if Windows Defender is in use or enabled: Open "PowerShell". Enter "get-service | where {$_.DisplayName -Like "*Defender*"} | Select Status,DisplayName” Verify if third-party anti-virus is in use or enabled: Open "PowerShell". Enter "get-service | where {$_.DisplayName -Like "*mcafee*"} | Select Status,DisplayName” Enter "get-service | where {$_.DisplayName -Like "*symantec*"} | Select Status,DisplayName”

Fix Text

If no anti-virus software is in use, install Windows Defender or third-party anti-virus. Open "PowerShell". Enter "Install-WindowsFeature -Name Windows-Defender” For third-party anti-virus, install per anti-virus instructions and disable Windows Defender. Open "PowerShell". Enter “Uninstall-WindowsFeature -Name Windows-Defender”.

V-224831 CAT I Local volumes must use a format that supports NTFS attribute...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 23FFCAA6C6211240C05DB0BA16F53867DB70E6FF ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: Windows File System: NTFS Device ID: D: Drive Type: Local Disk (3) Volume Name: PROGLOGS File System: NTFS Device ID: E: Drive Type: Local Disk (3) Volume Name: DATA File System: NTFS Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 12939B13563B98C1C0E9CF7E99396A1849389DE8 ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: BE-002-OS File System: NTFS Device ID: D: Drive Type: Local Disk (3) Volume Name: PROGLOGS File System: NTFS Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 27E3EFED84E2366F9C7E05423896CE7B66B7D30A ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: DB-002-OS File System: NTFS Device ID: D: Drive Type: Local Disk (3) Volume Name: PROGLOGS File System: NTFS Device ID: E: Drive Type: Local Disk (3) Volume Name: DATA File System: NTFS Device ID: G: Drive Type: Local Disk (3) Volume Name: LogiQuest File System: NTFS Device ID: O: Drive Type: Local Disk (3) Volume Name: IBS File System: NTFS Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 970CB0CF367610B48D3175A7F6732146B363AA1D ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: DC-003-OS File System: NTFS Device ID: D: Drive Type: Local Disk (3) Volume Name: PROGLOGS File System: NTFS Device ID: E: Drive Type: Local Disk (3) Volume Name: AD-SYSVOL File System: NTFS Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE8384DF4A6DF1101B40668690E53B482CFFDD59 ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: Windows File System: NTFS Device ID: E: Drive Type: Local Disk (3) Volume Name: New Volume File System: NTFS Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 94622EDF56DD29A3ACA656BF9588E97EB7B69BA3 ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: MB-002-OS File System: NTFS Device ID: D: Drive Type: Local Disk (3) Volume Name: PROGLOGS File System: NTFS Device ID: E: Drive Type: Local Disk (3) Volume Name: Exchange File System: NTFS Device ID: M: Drive Type: Local Disk (3) Volume Name: Mailbox File System: NTFS Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 5CA0759465086F9D66DF595519D98FCAA4B739D2 ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: Windows File System: NTFS Device ID: E: Drive Type: Local Disk (3) Volume Name: VMs File System: NTFS Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 5CA0759465086F9D66DF595519D98FCAA4B739D2 ~~~~~ All disk file systems are NTFS or ReFS. Device ID: C: Drive Type: Local Disk (3) Volume Name: Windows File System: NTFS Device ID: E: Drive Type: Local Disk (3) Volume Name: VMs File System: NTFS Comments

Check Text

Open "Computer Management". Select "Disk Management" under "Storage". For each local volume, if the file system does not indicate "NTFS", this is a finding. "ReFS" (resilient file system) is also acceptable and would not be a finding. This does not apply to system partitions such the Recovery and EFI System Partition.

Fix Text

Format volumes to use NTFS or ReFS.

V-224843 CAT I Systems requiring data at rest protections must employ crypt...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. If they do not, this is a finding.

Fix Text

Configure systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data to employ encryption to protect the confidentiality and integrity of all information at rest.

V-224874 CAT I Windows Server 2016 reversible password encryption must be d...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0C3874C178BF034376FC830F77095A4B14233118 ~~~~~ 'Store passwords using reversible encryption' is Disabled ClearTextPassword: 0 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Store passwords using reversible encryption" is not set to "Disabled", this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt If "ClearTextPassword" equals "1" in the file, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled".

V-224932 CAT I AutoPlay must be turned off for non-volume devices.

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 06CF0EC4F30E3C377A3E10B39BA0BD384D98F394 ~~~~~ 'Disallow Autoplay for non-volume devices' is Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Value: 0x00000001 (1) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Type: REG_DWORD Value: 0x00000001 (1)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices" to "Enabled".

V-224933 CAT I The default AutoRun behavior must be configured to prevent A...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 763263DA63BB845D32A031E492E9C3FA975310FB ~~~~~ 'Set the default behavior for AutoRun' is Enabled with 'Do not execute any autorun commands' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Value: 0x00000001 (1) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Type: REG_DWORD Value: 0x00000001 (1)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun" to "Enabled" with "Do not execute any autorun commands" selected.

V-224934 CAT I AutoPlay must be disabled for all drives.

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: AE0235811E2BDD415A15CD26D20BB620C605AC2D ~~~~~ 'Turn off AutoPlay' is Enabled with 'All Drives' Registry Path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Value: 0x000000ff (255) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Type: REG_DWORD Value: 0x000000ff (255)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay" to "Enabled" with "All Drives" selected.

V-224954 CAT I The Windows Installer Always install with elevated privilege...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B8FA2EABE0FF7A96734CD88AEF585CD72E3FFAE8 ~~~~~ 'Always install with elevated privileges' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value: 0x00000000 (0) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Type: REG_DWORD Value: 0x00000000 (0)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".

V-224958 CAT I The Windows Remote Management (WinRM) client must not use Ba...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E4E40CE41CC8DAC825405E07025044FB81EE5440 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Type: REG_DWORD Value: 0x00000000 (0)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled".

V-224961 CAT I The Windows Remote Management (WinRM) service must not use B...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 68310D9F3AC255CDE6A52457A3F8A1FBA287B140 ~~~~~ 'Allow Basic authentication' is Disabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value: 0x00000000 (0) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Type: REG_DWORD Value: 0x00000000 (0)

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled".

V-224964 CAT I Only administrators responsible for the domain controller mu...

8 assets 1 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: AECE488AF9D6FA206476E02B634ED70FCEA9659F ~~~~~ The following are members of the local Administrators group: --------------------- Name: MONTFORD-POINT\DOD_Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1000 Name: MONTFORD-POINT\Domain Admins objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-512 Name: MONTFORD-POINT\Enterprise Admins objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-519 Name: MONTFORD-POINT\MONT-EM-Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1157 Name: MONTFORD-POINT\Montford.backup objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1614 Name: MONTFORD-POINT\montford.exchange objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1118 Name: MONTFORD-POINT\SHB_Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-500 Name: MONTFORD-POINT\tagavrilovic.iaadmin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1231 Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. A separate version applies to other systems. Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. Standard user accounts must not be members of the local administrator group. If prohibited accounts are members of the local administrators group, this is a finding. If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.

Fix Text

Configure the Administrators group to include only administrator groups or accounts that are responsible for the system. Remove any standard user accounts.

V-224970 CAT I Permissions on the Active Directory data files must only all...

8 assets 1 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 3892B0B5063C129F18466B33431EF51304032F8C ~~~~~ There are 12 compliant files out of 12 total file(s) in 'E:\Logs'. There are 1 compliant files out of 1 total files in 'E:\Logs'. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Run "Regedit". Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". Note the directory locations in the values for: Database log files path DSA Database file By default, they will be \Windows\NTDS. If the locations are different, the following will need to be run for each. Open "Command Prompt (Admin)". Navigate to the NTDS directory (\Windows\NTDS by default). Run "icacls *.*". If the permissions on each file are not as restrictive as the following, this is a finding. NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) (I) - permission inherited from parent container (F) - full access

Fix Text

Maintain the permissions on NTDS database and log files as follows: NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) (I) - permission inherited from parent container (F) - full access

V-224971 CAT I The Active Directory SYSVOL directory must have the proper a...

8 assets 1 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details NT AUTHORITY\Authenticated Users:(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) BUILTIN\Server Operators:(RX) BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) BUILTIN\Administrators:(RX,W,WDAC,WO) BUILTIN\Administrators:(OI)(CI)(IO)(WDAC,WO,GR,GW,GE) NT AUTHORITY\SYSTEM:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) CREATOR OWNER:(OI)(CI)(IO)(WDAC,WO,GR,GW,GE) --------------------- Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Open a command prompt. Run "net share". Make note of the directory location of the SYSVOL share. By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. The default permissions noted below meet this requirement. Open "Command Prompt". Run "icacls c:\Windows\SYSVOL". The following results should be displayed: NT AUTHORITY\Authenticated Users:(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) BUILTIN\Server Operators:(RX) BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) BUILTIN\Administrators:(M,WDAC,WO) BUILTIN\Administrators:(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M,WDAC,WO) CREATOR OWNER:(OI)(CI)(IO)(F) (RX) - Read & execute Run "icacls /help" to view definitions of other permission codes.

Fix Text

Maintain the permissions on the SYSVOL directory. Do not allow greater than "Read & execute" permissions for standard user accounts or groups. The defaults below meet this requirement. C:\Windows\SYSVOL Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to Authenticated Users - Read & execute - This folder, subfolder, and files Server Operators - Read & execute- This folder, subfolder, and files Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) CREATOR OWNER - Full control - Subfolders and files only Administrators - Full control - Subfolders and files only SYSTEM - Full control - This folder, subfolders, and files

V-224972 CAT I Active Directory Group Policy objects must have proper acces...

8 assets Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 0C64CE6EC5AA5EE43B5C88120001A05A00313856 ~~~~~ GPO Name: AR21 - Edge FIX FEB2022 GPO GUID: 003a4b00-8a6c-4430-82c7-eb242f312734 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Internet Explorer 11 V1R19 - User GPO GUID: 009ff87d-d932-441b-a2f6-3ba585dc8949 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: Domain User Pol Adds 04-22 GPO GUID: 0ab94efd-80cb-4182-8be0-4d5c77808fad --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Microsoft Edge v1r1 Computer GPO GUID: 0df1b468-68c7-4e60-bd66-971fbbabb95a --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: DotNet4 Fix 04-22 GPO GUID: 114ae059-841b-429a-aa8a-cea9346c4aa4 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - BitLocker Backup to Active Directory GPO GUID: 13cf8084-13ec-427b-9cab-f3243723b027 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: V-236000 Preview pane 02-22 GPO GUID: 18de13be-ce1c-4e53-9612-e440386ed806 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Microsoft Office 2016 - Outlook V2R1 User GPO GUID: 1adacc11-67f9-42e9-be04-f32b3799dcc6 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: Firefox 04-22 GPO GUID: 202579c9-9c90-480b-a706-cd206212448b --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Server Event Log Backup GPO GUID: 211d022b-3225-4167-99e4-0c48f09f6567 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Adobe Reader DC Continuous V1R2 User GPO GUID: 2401b4fb-1b36-42a9-84c3-4340dc2e7502 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Microsoft Office 2016 - PowerPoint V1R1 User GPO GUID: 27a66feb-16c8-4d31-85c6-38bd47c8fd20 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: Server Event Logs GPO GUID: 2e1d00fc-0115-4b8b-8c28-f17f7cc47ed4 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: Default Domain Policy GPO GUID: 31b2f340-016d-11d2-945f-00c04fb984f9 --------------------- Trustee : Domain Admins TrusteeType : Group Permission : GpoCustom Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoCustom Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False --------------------- GPO Name: AR21 - Windows 10 FIX FEB2022 GPO GUID: 330cdbf2-c03b-4b9c-b9ec-b6b872dde8db --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Disable Sleep/Hibernate GPO GUID: 35d3d931-a7dc-4b8b-9be0-a67cfbd6268d --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Adobe Add-In Removal GPO GUID: 3a0de786-3214-4547-b689-920a1783dd34 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Support Users Drive Mapping GPO GUID: 3c0b7467-8063-47b4-844e-2b1db72234f6 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Internet Explorer 11 V1R19 - Computer GPO GUID: 3c3c67e4-a139-4561-af7b-d5ac7cae2ad1 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Google Chrome FIX FEB2022 GPO GUID: 4077a504-b830-4b59-868a-35847b93e9c6 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR 2.1 - LAPS Configuration Policy GPO GUID: 446e9640-684e-4528-a16f-a72f31b95b67 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Google Chrome V2R1 - Computer GPO GUID: 466a3169-b8b0-4e46-bc61-6ca031284f5e --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: V-2244896 V-224897 Audits 02-22 GPO GUID: 5101821e-891e-495e-ad1b-05150a0fb41c --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Mozilla Firefox FIX FEB2022 GPO GUID: 5464ea36-f45c-4be0-89e6-a0043741fa96 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: Map CAC GPO GUID: 54f949d4-864c-40fc-9756-59a367edaf66 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Disable print spooler inbound GPO GUID: 57995639-3cc1-481e-871d-b60d68b54f2a --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - OneNote and OneDrive STIGs GPO GUID: 57db8f1d-cf8e-45dd-afb2-4747c1fa02e8 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Add Server Admins to Local Administrators GPO GUID: 59e937c0-585e-4d7a-b2bc-17f943583d35 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Microsoft Office 2016 - Office System V1R1 Computer GPO GUID: 5ad817c7-2bbb-40fa-b6ce-ad8ac845a998 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: User Pol 4 Exchange 5-22 GPO GUID: 5ce6ea3f-55a6-49f0-bf68-18a8bcc32bfb --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Windows 10 v2r1 Computer GPO GUID: 633bf66a-4f82-4562-a78f-eefa83686f95 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: Default Domain Controllers Policy GPO GUID: 6ac1786c-016f-11d2-945f-00c04fb984f9 --------------------- Trustee : Domain Admins TrusteeType : Group Permission : GpoCustom Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoCustom Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False --------------------- GPO Name: AR21 - Axway Enterprise Configuration GPO GUID: 6c45f92c-56f0-46e4-a921-2ffbdc92a92a --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Windows 10 v2r1 User GPO GUID: 6f85b0d1-36d3-491e-91c4-c6ba3cef6d91 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Adobe Disable FIPS GPO GUID: 6faf5e3a-caf7-4ac5-a9b3-201db0ca8011 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Adobe Reader DC Continuous protected view MAR2022 GPO GUID: 73fb4c08-5e4e-4613-9c92-a1935473c0b8 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Microsoft Office 2016 - Word V1R1 User GPO GUID: 795e8ed2-6ce5-4658-a2c3-d52595e7c6e3 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Microsoft Office 2016 - Office System V1R1 User GPO GUID: 7cf27d8d-3025-453a-a598-1c52df19feba --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Adobe Reader DC Continuous V1R2 Computer GPO GUID: 80340fc8-26a3-4c92-a327-dea83f1ed6d6 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Windows Server 2016 V2R1 - DC - Computer GPO GUID: 816b5f36-4efa-4a32-82c0-a88cf0cecbf3 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - RBAC GPO GUID: 88602f3d-3a9f-4447-934a-2dde7e6ac06d --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Axway Configuration GPO GUID: 9a2e7ffb-86b0-4c62-bfc8-6e7ac786a1ed --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: V-224921 Hardened UNC 02-22 GPO GUID: 9f2930fd-254e-4f1b-ae4d-722bb9f35b41 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: DoD Adobe Acrobat Pro DC Continuous STIG Computer V1R2 GPO GUID: a1c7ddff-5f74-49b9-9ac2-f92d1735189a --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : ENTERPRISE DOMAIN CONTROLLERS TrusteeType : WellKnownGroup Permission : GpoRead Inherited : False Trustee : SYSTEM TrusteeType : WellKnownGroup Permission : GpoEditDeleteModifySecurity Inherited : False --------------------- GPO Name: AR21 - Drive Mapping GPO GUID: a5fcab78-2b37-4b84-8487-bcd275a129a6 --------------------- Trustee : Authenticated Users TrusteeType : WellKnownGroup Permission : GpoApply Inherited : False Trustee : Domain Admins TrusteeType : Group Permission : GpoEditDeleteModifySecurity Inherited : False Trustee : Enterprise Admins TrusteeType : Group Permission : GpoEditDeleteModify ---truncated results. met character limit--- Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Review the permissions on Group Policy objects. Open "Group Policy Management" (available from various menus or run "gpmc.msc"). Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). For each Group Policy object: Select the Group Policy object item in the left pane. Select the "Delegation" tab in the right pane. Select the "Advanced" button. Select each Group or user name. View the permissions. If any standard user accounts or groups have "Allow" permissions greater than "Read" and "Apply group policy", this is a finding. Other access permissions that allow the objects to be updated are considered findings unless specifically documented by the ISSO. The default permissions noted below satisfy this requirement. The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next "Advanced" button, the desired Permission entry, and the "Edit" button. Authenticated Users - Read, Apply group policy, Special permissions The special permissions for Authenticated Users are for Read-type Properties. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. The special permissions for the following default groups are not the focus of this requirement and may include a wide range of permissions and properties. CREATOR OWNER - Special permissions SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects.

Fix Text

Maintain the permissions on Group Policy objects to not allow greater than "Read" and "Apply group policy" for standard user accounts or groups. The default permissions below meet this requirement. Authenticated Users - Read, Apply group policy, Special permissions The special permissions for Authenticated Users are for Read-type Properties. CREATOR OWNER - Special permissions SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions Document any other access permissions that allow the objects to be updated with the ISSO. The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on created Group Policy objects.

V-224973 CAT I The Active Directory Domain Controllers Organizational Unit ...

8 assets Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 4D85055B89AC35AB27B6E3B6664B1897035F6EC4 ~~~~~ OU Name : Domain Controllers OU DN : OU=Domain Controllers,DC=MONTFORD-POINT,DC=navy,DC=mil --------------------- IdentityReference : BUILTIN\Administrators ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ListChildren AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : CREATOR OWNER ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : MONTFORD-POINT\Delegated Setup ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Domain Admins ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : CreateChild AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : DeleteTree AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : ExtendedRight AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete, WriteDacl AccessControlType : Allow IdentityReference : MONTFORD-POINT\Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\NETWORK SERVICE ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty, ExtendedRight AccessControlType : Allow IdentityReference : NT AUTHORITY\SYSTEM ActiveDirectoryRights : GenericAll AccessControlType : Allow --------------------- Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Review the permissions on the Domain Controllers OU. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Select "Advanced Features" in the "View" menu if not previously selected. Select the "Domain Controllers" OU (folder in folder icon). Right-click and select "Properties". Select the "Security" tab. If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. The default permissions listed below satisfy this requirement. Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button. Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. CREATOR OWNER - Special permissions SELF - Special permissions Authenticated Users - Read, Special permissions The special permissions for Authenticated Users are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. SYSTEM - Full Control Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions Enterprise Admins - Full Control Key Admins - Special permissions Enterprise Key Admins - Special permissions Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions Pre-Windows 2000 Compatible Access - Special permissions The Special permissions for Pre-Windows 2000 Compatible Access are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions

Fix Text

Limit the permissions on the Domain Controllers OU to restrict changes to System, Domain Admins, Enterprise Admins and Administrators. The default permissions listed below satisfy this requirement. Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions. CREATOR OWNER - Special permissions SELF - Special permissions Authenticated Users - Read, Special permissions The special permissions for Authenticated Users are Read types. SYSTEM - Full Control Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions Enterprise Admins - Full Control Key Admins - Special permissions Enterprise Key Admins - Special permissions Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions Pre-Windows 2000 Compatible Access - Special permissions The special permissions for Pre-Windows 2000 Compatible Access are Read types. ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions

V-224974 CAT I Domain-created Active Directory Organizational Unit (OU) obj...

8 assets Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: D7A161EFD64DBDC717E086EA4DB84B3724C238CF ~~~~~ OU Name : ASHORE SUPPORT OU DN : OU=ASHORE SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil --------------------- IdentityReference : BUILTIN\Account Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : BUILTIN\Administrators ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ListChildren AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : BUILTIN\Print Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : CREATOR OWNER ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : Everyone ActiveDirectoryRights : DeleteChild, DeleteTree, Delete AccessControlType : Deny IdentityReference : MONTFORD-POINT\Delegated Setup ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Domain Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : CreateChild AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : DeleteTree AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : ExtendedRight AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete, WriteDacl AccessControlType : Allow IdentityReference : MONTFORD-POINT\Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\NETWORK SERVICE ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty, ExtendedRight AccessControlType : Allow IdentityReference : NT AUTHORITY\SYSTEM ActiveDirectoryRights : GenericAll AccessControlType : Allow --------------------- OU Name : GROUPS OU DN : OU=GROUPS,OU=ASHORE SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil --------------------- IdentityReference : BUILTIN\Account Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : BUILTIN\Administrators ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ListChildren AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : BUILTIN\Print Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : CREATOR OWNER ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : Everyone ActiveDirectoryRights : DeleteTree, Delete AccessControlType : Deny IdentityReference : MONTFORD-POINT\Delegated Setup ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Domain Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : CreateChild AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : DeleteTree AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : ExtendedRight AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete, WriteDacl AccessControlType : Allow IdentityReference : MONTFORD-POINT\Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\NETWORK SERVICE ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty, ExtendedRight AccessControlType : Allow IdentityReference : NT AUTHORITY\SYSTEM ActiveDirectoryRights : GenericAll AccessControlType : Allow --------------------- OU Name : USERS OU DN : OU=USERS,OU=ASHORE SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil --------------------- IdentityReference : BUILTIN\Account Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : BUILTIN\Administrators ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ListChildren AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : BUILTIN\Print Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : CREATOR OWNER ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : Everyone ActiveDirectoryRights : DeleteTree, Delete AccessControlType : Deny IdentityReference : MONTFORD-POINT\Delegated Setup ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Domain Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : CreateChild AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : DeleteTree AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : ExtendedRight AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete, WriteDacl AccessControlType : Allow IdentityReference : MONTFORD-POINT\Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\NETWORK SERVICE ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty, ExtendedRight AccessControlType : Allow IdentityReference : NT AUTHORITY\SYSTEM ActiveDirectoryRights : GenericAll AccessControlType : Allow --------------------- OU Name : Disabled_Accounts OU DN : OU=Disabled_Accounts,DC=MONTFORD-POINT,DC=navy,DC=mil --------------------- IdentityReference : BUILTIN\Account Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : BUILTIN\Administrators ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ListChildren AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : BUILTIN\Print Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : CREATOR OWNER ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : Everyone ActiveDirectoryRights : DeleteTree, Delete AccessControlType : Deny IdentityReference : MONTFORD-POINT\Delegated Setup ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Domain Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : CreateChild AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : DeleteTree AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : ExtendedRight AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete, WriteDacl AccessControlType : Allow IdentityReference : MONTFORD-POINT\Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\NETWORK SERVICE ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty, ExtendedRight AccessControlType : Allow IdentityReference : NT AUTHORITY\SYSTEM ActiveDirectoryRights : GenericAll AccessControlType : Allow --------------------- OU Name : GALSYNC OU DN : OU=GALSYNC,DC=MONTFORD-POINT,DC=navy,DC=mil --------------------- IdentityReference : BUILTIN\Account Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : BUILTIN\Administrators ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ListChildren AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : BUILTIN\Print Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : CREATOR OWNER ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : Everyone ActiveDirectoryRights : DeleteTree, Delete AccessControlType : Deny IdentityReference : MONTFORD-POINT\Delegated Setup ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Domain Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : CreateChild AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : DeleteTree AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : ExtendedRight AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete, WriteDacl AccessControlType : Allow IdentityReference : MONTFORD-POINT\Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\Authenticated Users ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : NT AUTHORITY\NETWORK SERVICE ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : NT AUTHORITY\SELF ActiveDirectoryRights : ReadProperty, WriteProperty, ExtendedRight AccessControlType : Allow IdentityReference : NT AUTHORITY\SYSTEM ActiveDirectoryRights : GenericAll AccessControlType : Allow --------------------- OU Name : MEMBER SERVERS OU DN : OU=MEMBER SERVERS,DC=MONTFORD-POINT,DC=navy,DC=mil --------------------- IdentityReference : BUILTIN\Account Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : BUILTIN\Administrators ActiveDirectoryRights : CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ListChildren AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : BUILTIN\Pre-Windows 2000 Compatible Access ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : BUILTIN\Print Operators ActiveDirectoryRights : CreateChild, DeleteChild AccessControlType : Allow IdentityReference : CREATOR OWNER ActiveDirectoryRights : Self AccessControlType : Allow IdentityReference : Everyone ActiveDirectoryRights : DeleteTree, Delete AccessControlType : Deny IdentityReference : MONTFORD-POINT\Delegated Setup ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Domain Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Admins ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Enterprise Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : ReadProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Servers ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, ListObject AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Trusted Subsystem ActiveDirectoryRights : GenericAll AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : CreateChild AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : DeleteTree AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : ExtendedRight AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete AccessControlType : Allow IdentityReference : MONTFORD-POINT\Exchange Windows Permissions ActiveDirectoryRights : Delete, WriteDacl AccessControlType : Allow IdentityReference : MONTFORD-POINT\Key Admins ActiveDirectoryRights : ReadProperty, WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : WriteProperty AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericRead AccessControlType : Allow IdentityReference : MONTFORD-POINT\Organization Management ActiveDirectoryRights : GenericAll AccessControlType ---truncated results. met character limit--- Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Review the permissions on domain-defined OUs. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Ensure "Advanced Features" is selected in the "View" menu. For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: Right-click the OU and select "Properties". Select the "Security" tab. If the permissions on the OU are not at least as restrictive as those below, this is a finding. The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. CREATOR OWNER - Special permissions Self - Special permissions Authenticated Users - Read, Special permissions The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. SYSTEM - Full Control Domain Admins - Full Control Enterprise Admins - Full Control Key Admins - Special permissions Enterprise Key Admins - Special permissions Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions Pre-Windows 2000 Compatible Access - Special permissions The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs).

Fix Text

Maintain the permissions on domain-defined OUs to be at least as restrictive as the defaults below. Document any additional permissions above Read with the ISSO if an approved distributed administration model (help desk or other user support staff) is implemented. CREATOR OWNER - Special permissions Self - Special permissions Authenticated Users - Read, Special permissions The special permissions for Authenticated Users are Read type. SYSTEM - Full Control Domain Admins - Full Control Enterprise Admins - Full Control Key Admins - Special permissions Enterprise Key Admins - Special permissions Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions Pre-Windows 2000 Compatible Access - Special permissions The special permissions for Pre-Windows 2000 Compatible Access are for Read types. ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions

V-224978 CAT I Directory data (outside the root DSE) of a non-public direct...

8 assets 1 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Open "Command Prompt" (not elevated). Run "ldp.exe". From the "Connection menu", select "Bind". Clear the User, Password, and Domain fields. Select "Simple bind" for the Bind type and click "OK". Confirmation of anonymous access will be displayed at the end: res = ldap_simple_bind_s Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON' From the "Browse" menu, select "Search". In the Search dialog, enter the DN of the domain naming context (generally something like "dc=disaost,dc=mil") in the Base DN field. Clear the Attributes field and select "Run". Error messages should display related to Bind and user not authenticated. If attribute data is displayed, anonymous access is enabled to the domain naming context and this is a finding. The following network controls allow the finding severity to be downgraded to a CAT II since these measures lower the risk associated with anonymous access. Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address.

Fix Text

Configure directory data (outside the root DSE) of a non-public directory to prevent anonymous access. For AD, there are multiple configuration items that could enable anonymous access. Changing the access permissions on the domain naming context object (from the secure defaults) could enable anonymous access. If the check procedures indicate this is the cause, the process that was used to change the permissions should be reversed. This could have been through the Windows Support Tools ADSI Edit console (adsiedit.msc). The dsHeuristics option is used. This is addressed in check V-8555 in the AD Forest STIG.

V-224992 CAT I Domain Controller PKI certificates must be issued by the DoD...

8 assets 1 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7115114BC716F19307736882EE1C307D4B1D4754 ~~~~~ Compliant Certificates: --------------------------- Subject: CN=MONT-DC-003.MONTFORD-POINT.navy.mil, OU=USN, OU=PKI, OU=DoD, O=U.S. Government, C=US CertStore: LocalMachine\My Issuer: CN=DOD SW CA-67, OU=PKI, OU=DoD, O=U.S. Government, C=US FriendlyName: MONT-DC-003.MONTFORD-POINT.navy.mil NotAfter: 06/08/2026 17:58:05 Thumbprint: 09D2721B5061A5BD0B8E3C771D94CCF915BA291C KDCAuthKey: KDC Authentication (1.3.6.1.5.2.3.5) ApprovedChain: True CertificationPath... (0) - DoD Root CA 3 (1) - DOD SW CA-67 (2) - MONT-DC-003.MONTFORD-POINT.navy.mil Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: F7DE991FB49346C9EC2F2DEEB9D564F37D7ACC9E ~~~~~ System is a 'Member Server' so this requirement is NA. Comments

Check Text

This applies to domain controllers. It is NA for other systems. Run "MMC". Select "Add/Remove Snap-in" from the "File" menu. Select "Certificates" in the left pane and click the "Add >" button. Select "Computer Account" and click "Next". Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". Click "OK". Select and expand the Certificates (Local Computer) entry in the left pane. Select and expand the Personal entry in the left pane. Select the Certificates entry in the left pane. In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: http://iase.disa.mil/pki-pke/function_pages/tools.html

Fix Text

Obtain a server certificate for the domain controller issued by the DoD PKI or an approved ECA.

V-225025 CAT I Local accounts with blank passwords must be restricted to pr...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7AC1D020AB6148539D57E4FB73B39D6CD29DBDBF ~~~~~ 'Accounts: Limit local account use of blank passwords to console logon only' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value: 0x00000001 (1) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value Type: REG_DWORD Value: 0x00000001 (1)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".

V-225044 CAT I Anonymous SID/Name translation must not be allowed.

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: A51800A7EB71E8DB49CCE183B779719692119D7F ~~~~~ 'Network access: Allow anonymous SID/Name translation' is Disabled LSAAnonymousNameLookup: 0 Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding. For server core installations, run the following command: Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt If "LSAAnonymousNameLookup" equals "1" in the file, this is a finding.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation" to "Disabled".

V-225045 CAT I Anonymous enumeration of Security Account Manager (SAM) acco...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 626DA34A65C05C1C220101534FE1788BBD495E56 ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value: 0x00000001 (1) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DWORD Value: 0x00000001 (1)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".

V-225046 CAT I Anonymous enumeration of shares must not be allowed.

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B5021F1C8C390A907EFF7C0B541B8772B1C668D ~~~~~ 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value: 0x00000001 (1) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value Type: REG_DWORD Value: 0x00000001 (1)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".

V-225048 CAT I Anonymous access to Named Pipes and Shares must be restricte...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E07BBC4D71D24D912C7B7521C5945409D833E711 ~~~~~ 'Network access: Restrict anonymous access to Named Pipes and Shares' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value: 0x00000001 (1) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value Type: REG_DWORD Value: 0x00000001 (1)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".

V-225053 CAT I Windows Server 2016 must be configured to prevent the storag...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 59F308CA0C17B53FC330F51C46C1E3AB01AF5CBA ~~~~~ 'Network security: Do not store LAN Manager hash value on next password change' is Enabled Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value: 0x00000001 (1) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value Type: REG_DWORD Value: 0x00000001 (1)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".

V-225054 CAT I The LAN Manager authentication level must be set to send NTL...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C7D726018F3C569FF8F159C3F0E17B69F73A5254 ~~~~~ 'Network security: LAN Manager authentication level' is Configured with 'Send NTLMv2 response only. Refuse LM & NTLM' Registry Path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value: 0x00000005 (5) Type: REG_DWORD Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value Type: REG_DWORD Value: 0x00000005 (5)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".

V-225071 CAT I The Act as part of the operating system user right must not ...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: FE3BC21CE05FC8AF06B5779CBF8444CACC0434C3 ~~~~~ Act as part of the operating system: No objects assigned to this right. Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs are granted the "SeTcbPrivilege" user right, this is a finding. If an application requires this user right, this would not be a finding. Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070). Passwords for accounts with this user right must be protected as highly privileged accounts.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).

V-225079 CAT I The Debug programs user right must only be assigned to the A...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E5554733A1BAD484044698CCA1825B99C1BA28E2 ~~~~~ Debug programs: BUILTIN\Administrators Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding. - Administrators For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs other than the following are granted the "SeDebugPrivilege" user right, this is a finding. S-1-5-32-544 (Administrators) If an application requires this user right, this would not be a finding. Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070). Passwords for application accounts with this user right must be protected as highly privileged accounts.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to include only the following accounts or groups: - Administrators

V-225091 CAT I The Create a token object user right must not be assigned to...

8 assets 8 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: DC364635E02E4550D6A89063BCA91A5342767023 ~~~~~ Create a token object: No objects assigned to this right. Comments

Check Text

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups are granted the "Create a token object" user right, this is a finding. If an application requires this user right, this would not be a finding. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs are granted the "SeCreateTokenPrivilege" user right, this is a finding. Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070). Passwords for application accounts with this user right must be protected as highly privileged accounts.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).

V-224820 CAT II Passwords for the built-in Administrator account must be cha...

8 assets 8 Open Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 02584B707ED8F7A6BBB550AB8007006439022FB2 ~~~~~ Password for the built-in Administrator account (X_Admin) was last changed on 01/14/2021 03:03:50 (1743 days ago) Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 71A62659BD0BD5A65A87B978C8A286286D2E160D ~~~~~ Password for the built-in Administrator account (X_Admin) was last changed on 03/24/2021 16:46:13 (1673 days ago) Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 02584B707ED8F7A6BBB550AB8007006439022FB2 ~~~~~ Password for the built-in Administrator account (X_Admin) was last changed on 01/14/2021 03:03:50 (1743 days ago) Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: F1A30B85277550AD2072CFAC46AEF4298B54F106 ~~~~~ Password for the built-in Administrator account (SHB_Admin) was last changed on 03/24/2021 16:46:13 (1674 days ago) Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 71A62659BD0BD5A65A87B978C8A286286D2E160D ~~~~~ Password for the built-in Administrator account (X_Admin) was last changed on 03/24/2021 16:46:13 (1673 days ago) Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 26572079BCCF907EB437A9106FA6A046FCCE8B31 ~~~~~ Password for the built-in Administrator account (SHB_Admin) was last changed on 03/24/2021 16:46:13 (1673 days ago) Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 72A6144099867FC3CBCFF6B8E32957D3D3A6873C ~~~~~ Password for the built-in Administrator account (X_Admin) was last changed on 05/12/2023 18:00:29 (894 days ago) Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 257887B5F9AFA7F486067185B8DA4FF4953E63BE ~~~~~ Password for the built-in Administrator account (X_Admin) was last changed on 05/12/2023 18:01:24 (894 days ago) Comments

Check Text

Review the password last set date for the built-in Administrator account. Domain controllers: Open "PowerShell". Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | Ft Name, SID, PasswordLastSet". If the "PasswordLastSet" date is greater than "60" days old, this is a finding. Member servers and standalone or nondomain-joined systems: Open "Command Prompt". Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. (The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) If the "PasswordLastSet" date is greater than "60" days old, this is a finding.

Fix Text

Change the built-in Administrator account password at least every "60" days. It is highly recommended to use Microsoft's LAPS, which may be used on domain-joined member servers to accomplish this. The AO still has the overall authority to use another equivalent capability to accomplish the check.

V-224825 CAT II Shared user accounts must not be permitted on the system.

8 assets 8 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Determine whether any shared accounts exist. If no shared accounts exist, this is NA. Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. If unapproved shared accounts exist, this is a finding.

Fix Text

Remove unapproved shared accounts from the system. Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.

V-224826 CAT II Windows Server 2016 must employ a deny-all, permit-by-except...

8 assets 8 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 6FF711AFAE14E49C15CD28D71EFFCBA6D6AF6065 ~~~~~ AppLocker is configured but 'Appx' and/or 'Exe' rules are not enabled. Ensure an application allowlisting solution is in place and configured to a deny-all, permit-by-exception policy. AppLocker rules: --------------------------- Rule Type: Appx Enforcement Mode: NotConfigured Rule Type: Dll Enforcement Mode: AuditOnly Rule Type: Exe Enforcement Mode: AuditOnly Rule Type: Msi Enforcement Mode: AuditOnly Rule Type: Script Enforcement Mode: AuditOnly Comments

Check Text

Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. If an application allowlisting program is not in use on the system, this is a finding. Configuration of allowlisting applications will vary by the program. AppLocker is an allowlisting application built into Windows Server. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. If AppLocker is used, perform the following to view the configuration of AppLocker: Open "PowerShell". If the AppLocker PowerShell module has not been imported previously, execute the following first: Import-Module AppLocker Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. Implementation guidance for AppLocker is available at the following link: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide

Fix Text

Configure an application allowlisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. Configuration of allowlisting applications will vary by the program. AppLocker is an allowlisting application built into Windows Server. If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. Implementation guidance for AppLocker is available at the following link: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide

V-224840 CAT II System files must be monitored for unauthorized changes.

8 assets 8 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Determine if the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. If system files are not being monitored for unauthorized changes, this is a finding. An approved and properly configured solution will contain both a list of baselines that includes all system file locations and a file comparison task that is scheduled to run at least weekly.

Fix Text

Monitor the system for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools.

V-224875 CAT II Audit records must be backed up to a different system or med...

8 assets 8 Open Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments Logs not backing up to D drive
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Determine if a process to back up log data to a different system or media than the system being audited has been implemented. If it has not, this is a finding.

Fix Text

Establish and implement a process for backing up log data to another system or media other than the system being audited.

V-224876 CAT II Windows Server 2016 must, at a minimum, offload audit record...

8 assets 8 Open Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Verify the audit records, at a minimum, are offloaded for interconnected systems in real time and offloaded for standalone or nondomain-joined systems weekly. If they are not, this is a finding.

Fix Text

Configure the system to, at a minimum, offload audit records of interconnected systems in real time and offload standalone or nondomain-joined systems weekly.

V-257502 CAT II Windows Server 2016 must have PowerShell Transcription enabl...

8 assets 8 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 053B5D828EEAF46570CDDCE5C77DBC62D21E42D7 ~~~~~ 'Turn on PowerShell Transcription' is NOT Enabled Registry Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting (Not found) Comments

Check Text

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription\ Value Name: EnableTranscripting Value Type: REG_DWORD Value: 1

Fix Text

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Transcription" to "Enabled". Specify the Transcript output directory to point to a Central Log Server or another secure location to prevent user access.

V-224845 CAT II The roles and features required by the system must be docume...

8 assets 7 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: BE7C19DDE65138A644FC9087711F70D0C7FDDD1C ~~~~~ Installed Roles: --------------------- File and Storage Services Installed Role Services: --------------------- File and iSCSI Services File Server Storage Services Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 WCF Services TCP Port Sharing Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE WoW64 Support Comments Documentation
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: D8478AC2FD162193D66BF534C4869D3538EB1F15 ~~~~~ Installed Roles: --------------------- File and Storage Services Installed Role Services: --------------------- Storage Services Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 WCF Services TCP Port Sharing Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE WoW64 Support Comments Documentation
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: BE7C19DDE65138A644FC9087711F70D0C7FDDD1C ~~~~~ Installed Roles: --------------------- File and Storage Services Installed Role Services: --------------------- File and iSCSI Services File Server Storage Services Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 WCF Services TCP Port Sharing Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE WoW64 Support Comments documentation
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: A5A792923F838BAD0506209E17CDD23EF6D8A091 ~~~~~ Installed Roles: --------------------- Active Directory Domain Services DHCP Server DNS Server File and Storage Services Network Policy and Access Services Installed Role Services: --------------------- File and iSCSI Services File Server Storage Services Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 WCF Services TCP Port Sharing BitLocker Drive Encryption Enhanced Storage Group Policy Management Remote Server Administration Tools Feature Administration Tools BitLocker Drive Encryption Administration Utilities BitLocker Drive Encryption Tools BitLocker Recovery Password Viewer Role Administration Tools AD DS and AD LDS Tools Active Directory module for Windows PowerShell AD DS Tools Active Directory Administrative Center AD DS Snap-Ins and Command-Line Tools Active Directory Certificate Services Tools Certification Authority Management Tools DHCP Server Tools DNS Server Tools Network Policy and Access Services Tools Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE WoW64 Support Comments documentation
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 7824D0431791E6B62B9758C503519101F503256D ~~~~~ Installed Roles: --------------------- File and Storage Services Web Server (IIS) Installed Role Services: --------------------- File and iSCSI Services File Server Storage Services Web Server Common HTTP Features Default Document Directory Browsing HTTP Errors Static Content HTTP Redirection Health and Diagnostics HTTP Logging Logging Tools Request Monitor Tracing Performance Static Content Compression Security Request Filtering Application Development ISAPI Extensions Management Tools IIS Management Console IIS 6 Management Compatibility IIS 6 Metabase Compatibility Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 WCF Services TCP Port Sharing Background Intelligent Transfer Service (BITS) IIS Server Extension Remote Differential Compression Remote Server Administration Tools Feature Administration Tools BITS Server Extensions Tools Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE WoW64 Support Comments documentation
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 07E552EDB99739489FC1F2A1156B524187533262 ~~~~~ Installed Roles: --------------------- File and Storage Services Web Server (IIS) Installed Role Services: --------------------- File and iSCSI Services File Server Storage Services Web Server Common HTTP Features Default Document Directory Browsing HTTP Errors Static Content HTTP Redirection Health and Diagnostics HTTP Logging Logging Tools Request Monitor Tracing Performance Static Content Compression Dynamic Content Compression Security Request Filtering Basic Authentication Client Certificate Mapping Authentication Digest Authentication Windows Authentication Application Development .NET Extensibility 4.6 ASP.NET 4.6 ISAPI Extensions ISAPI Filters Management Tools IIS Management Console IIS 6 Management Compatibility IIS 6 Metabase Compatibility IIS 6 Management Console IIS 6 WMI Compatibility Management Service Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 ASP.NET 4.6 WCF Services HTTP Activation Message Queuing (MSMQ) Activation Named Pipe Activation TCP Activation TCP Port Sharing Media Foundation Message Queuing Message Queuing Services Message Queuing Server Remote Server Administration Tools Feature Administration Tools Failover Clustering Tools Failover Cluster Management Tools Failover Cluster Module for Windows PowerShell Failover Cluster Command Interface Role Administration Tools AD DS and AD LDS Tools AD DS Tools AD DS Snap-Ins and Command-Line Tools RPC over HTTP Proxy Windows Identity Foundation 3.5 Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE Windows Process Activation Service Process Model Configuration APIs WoW64 Support Comments Documentation
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 8B6B0E7B29F63DCE6A1F8CA5BA16AADD4BF2ACD3 ~~~~~ Installed Roles: --------------------- File and Storage Services Hyper-V Installed Role Services: --------------------- File and iSCSI Services File Server Storage Services Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 WCF Services TCP Port Sharing Remote Server Administration Tools Role Administration Tools Hyper-V Management Tools Hyper-V GUI Management Tools Hyper-V Module for Windows PowerShell Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE WoW64 Support Comments documentation
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 8B6B0E7B29F63DCE6A1F8CA5BA16AADD4BF2ACD3 ~~~~~ Installed Roles: --------------------- File and Storage Services Hyper-V Installed Role Services: --------------------- File and iSCSI Services File Server Storage Services Installed Features: --------------------- .NET Framework 4.6 Features .NET Framework 4.6 WCF Services TCP Port Sharing Remote Server Administration Tools Role Administration Tools Hyper-V Management Tools Hyper-V GUI Management Tools Hyper-V Module for Windows PowerShell Windows PowerShell Windows PowerShell 5.1 Windows PowerShell ISE WoW64 Support Comments documentation

Check Text

Required roles and features will vary based on the function of the individual system. Roles and features specifically required to be disabled per the STIG are identified in separate requirements. If the organization has not documented the roles and features required for the system(s), this is a finding. The PowerShell command "Get-WindowsFeature" will list all roles and features with an "Install State".

Fix Text

Document the roles and features required for the system to operate. Uninstall any that are not required.

V-225015 CAT II The "Deny access to this computer from the network" user rig...

8 assets 7 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: B00433ABC682620256EEA18A128316CDE1BC2030 ~~~~~ Deny access to this computer from the network: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: B00433ABC682620256EEA18A128316CDE1BC2030 ~~~~~ Deny access to this computer from the network: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: B00433ABC682620256EEA18A128316CDE1BC2030 ~~~~~ Deny access to this computer from the network: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: C0F3904C423975C11B19B4BFBF943881A50CAA13 ~~~~~ System is a 'Primary Domain Controller' so this requirement is NA. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: B00433ABC682620256EEA18A128316CDE1BC2030 ~~~~~ Deny access to this computer from the network: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: B00433ABC682620256EEA18A128316CDE1BC2030 ~~~~~ Deny access to this computer from the network: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: B00433ABC682620256EEA18A128316CDE1BC2030 ~~~~~ Deny access to this computer from the network: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: B00433ABC682620256EEA18A128316CDE1BC2030 ~~~~~ Deny access to this computer from the network: BUILTIN\Guests NT AUTHORITY\Local account Comments

Check Text

This applies to member servers and standalone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding. Domain Systems Only: - Enterprise Admins group - Domain Admins group - "Local account and member of Administrators group" or "Local account" (see Note below) All Systems: - Guests group For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyNetworkLogonRight" user right, this is a finding. Domain Systems Only: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) S-1-5-114 ("Local account and member of Administrators group") or S-1-5-113 ("Local account") All Systems: S-1-5-32-546 (Guests) Note: These are built-in security groups. "Local account" is more restrictive but may cause issues on servers such as systems that provide failover clustering.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following: Domain Systems Only: - Enterprise Admins group - Domain Admins group - "Local account and member of Administrators group" or "Local account" (see Note below) All Systems: - Guests group Note: These are built-in security groups. "Local account" is more restrictive but may cause issues on servers such as systems that provide failover clustering.

V-225017 CAT II The "Deny log on as a service" user right on member servers ...

8 assets 7 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 853C0CE81C1C24F05FBE2ADC24FBC18BB9DC2A41 ~~~~~ Deny log on as a service: No objects assigned to this right. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 853C0CE81C1C24F05FBE2ADC24FBC18BB9DC2A41 ~~~~~ Deny log on as a service: No objects assigned to this right. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 853C0CE81C1C24F05FBE2ADC24FBC18BB9DC2A41 ~~~~~ Deny log on as a service: No objects assigned to this right. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: C0F3904C423975C11B19B4BFBF943881A50CAA13 ~~~~~ System is a 'Primary Domain Controller' so this requirement is NA. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 853C0CE81C1C24F05FBE2ADC24FBC18BB9DC2A41 ~~~~~ Deny log on as a service: No objects assigned to this right. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 853C0CE81C1C24F05FBE2ADC24FBC18BB9DC2A41 ~~~~~ Deny log on as a service: No objects assigned to this right. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 853C0CE81C1C24F05FBE2ADC24FBC18BB9DC2A41 ~~~~~ Deny log on as a service: No objects assigned to this right. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 853C0CE81C1C24F05FBE2ADC24FBC18BB9DC2A41 ~~~~~ Deny log on as a service: No objects assigned to this right. Comments

Check Text

This applies to member servers. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on as a service" user right on domain-joined systems, this is a finding. - Enterprise Admins Group - Domain Admins Group If any accounts or groups are defined for the "Deny log on as a service" user right on nondomain-joined systems, this is a finding. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyServiceLogonRight" user right on domain-joined systems, this is a finding. S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include the following: Domain systems: - Enterprise Admins Group - Domain Admins Group

V-225018 CAT II The "Deny log on locally" user right on member servers must ...

8 assets 7 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: D42DF0ECC417CB415089564874B6907BEB79128C ~~~~~ Deny log on locally: BUILTIN\Guests Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: D42DF0ECC417CB415089564874B6907BEB79128C ~~~~~ Deny log on locally: BUILTIN\Guests Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: D42DF0ECC417CB415089564874B6907BEB79128C ~~~~~ Deny log on locally: BUILTIN\Guests Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: C0F3904C423975C11B19B4BFBF943881A50CAA13 ~~~~~ System is a 'Primary Domain Controller' so this requirement is NA. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: D42DF0ECC417CB415089564874B6907BEB79128C ~~~~~ Deny log on locally: BUILTIN\Guests Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: D42DF0ECC417CB415089564874B6907BEB79128C ~~~~~ Deny log on locally: BUILTIN\Guests Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: D42DF0ECC417CB415089564874B6907BEB79128C ~~~~~ Deny log on locally: BUILTIN\Guests Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: D42DF0ECC417CB415089564874B6907BEB79128C ~~~~~ Deny log on locally: BUILTIN\Guests Comments

Check Text

This applies to member servers and standalone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding. Domain Systems Only: - Enterprise Admins Group - Domain Admins Group All Systems: - Guests Group For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyInteractiveLogonRight" user right, this is a finding. Domain Systems Only: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) All Systems: S-1-5-32-546 (Guests)

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following: Domain Systems Only: - Enterprise Admins Group - Domain Admins Group All Systems: - Guests Group

V-225019 CAT II The "Deny log on through Remote Desktop Services" user right...

8 assets 7 Open Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 5957234601D7C7E797928456B308E65804C7D53F ~~~~~ Deny log on through Remote Desktop Services: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 5957234601D7C7E797928456B308E65804C7D53F ~~~~~ Deny log on through Remote Desktop Services: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 5957234601D7C7E797928456B308E65804C7D53F ~~~~~ Deny log on through Remote Desktop Services: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: C0F3904C423975C11B19B4BFBF943881A50CAA13 ~~~~~ System is a 'Primary Domain Controller' so this requirement is NA. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 5957234601D7C7E797928456B308E65804C7D53F ~~~~~ Deny log on through Remote Desktop Services: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 5957234601D7C7E797928456B308E65804C7D53F ~~~~~ Deny log on through Remote Desktop Services: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 5957234601D7C7E797928456B308E65804C7D53F ~~~~~ Deny log on through Remote Desktop Services: BUILTIN\Guests NT AUTHORITY\Local account Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be OPEN on 10/23/2025 ResultHash: 5957234601D7C7E797928456B308E65804C7D53F ~~~~~ Deny log on through Remote Desktop Services: BUILTIN\Guests NT AUTHORITY\Local account Comments

Check Text

This applies to member servers and standalone or nondomain-joined systems. A separate version applies to domain controllers. Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding. Domain Systems Only: - Enterprise Admins group - Domain Admins group - Local account (see Note below) All Systems: - Guests group For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If the following SIDs are not defined for the "SeDenyRemoteInteractiveLogonRight" user right, this is a finding. Domain Systems Only: S-1-5-root domain-519 (Enterprise Admins) S-1-5-domain-512 (Domain Admins) S-1-5-113 ("Local account") All Systems: S-1-5-32-546 (Guests) Note: "Local account" is referring to the Windows built-in security group.

Fix Text

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following: Domain Systems Only: - Enterprise Admins group - Domain Admins group - Local account (see Note below) All Systems: - Guests group Note: "Local account" is referring to the Windows built-in security group.

V-224837 CAT II Outdated or unused accounts must be removed from the system ...

8 assets 6 Open 2 Closed Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 263DA351D2894952BBF8189FB6715621065B0A7F ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-3515710802-3801378020-2101878990-1000 Enabled: True Last Logon: 07/06/2023 06:31:47 [840 days] Comments Document account as a backup admin account: Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: FC31BBFC2CEB692BBFEF878BCFB3A77AD691415D ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-2559903909-3818771750-2130456036-1000 Enabled: True Last Logon: 07/06/2023 06:02:50 [840 days] Comments Documentation
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 11F54D137F8E9EEA8782F3EBBEC2DCD07E124714 ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-3489894170-526094123-3548415114-1000 Enabled: True Last Logon: 07/06/2023 06:13:35 [840 days] Comments documentation
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 1C7B892F561A2193CB86D61FA0145F6304D2D90B ~~~~~ Ignored Accounts: --------------------- Name: SHB_Admin SID: S-1-5-21-1360995287-4027491577-3040029667-500 Enabled: True Last Logon: Never Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1000 Enabled: True Last Logon: 06/24/2025 19:14:22 [120 days] Name: HealthMailbox3295a98105294ef195ff4f5394ae0e3c SID: S-1-5-21-1360995287-4027491577-3040029667-1606 Enabled: True Last Logon: Never Name: HealthMailbox8d8eb4c107e64340876668cde6c1289e SID: S-1-5-21-1360995287-4027491577-3040029667-1607 Enabled: True Last Logon: Never Name: HealthMailboxfd82eb3f816c4428bcc7a1706f017682 SID: S-1-5-21-1360995287-4027491577-3040029667-1608 Enabled: True Last Logon: Never Name: HealthMailbox4ffeb90d1e3e42808987669877a590dc SID: S-1-5-21-1360995287-4027491577-3040029667-1150 Enabled: True Last Logon: Never Name: HealthMailboxa7603ef65a894a7abd37cc7afcd0498f SID: S-1-5-21-1360995287-4027491577-3040029667-1609 Enabled: True Last Logon: Never Name: HealthMailbox0045b0edfe864ade8de6332392102884 SID: S-1-5-21-1360995287-4027491577-3040029667-1151 Enabled: True Last Logon: Never Name: HealthMailbox2a4e029adc2c45d7a2377f21fc959267 SID: S-1-5-21-1360995287-4027491577-3040029667-1610 Enabled: True Last Logon: Never Name: HealthMailboxff1c61cd50724325bd1467262f3ab3f7 SID: S-1-5-21-1360995287-4027491577-3040029667-1611 Enabled: True Last Logon: Never Name: HealthMailbox476aa3607f714413bb95f561ccbef1c1 SID: S-1-5-21-1360995287-4027491577-3040029667-1152 Enabled: True Last Logon: Never Name: MONT-EM-NAA SID: S-1-5-21-1360995287-4027491577-3040029667-1154 Enabled: True Last Logon: Never Name: MONT-EM-SVRCP SID: S-1-5-21-1360995287-4027491577-3040029667-1155 Enabled: True Last Logon: Never Name: MONT-EM-WKSCP SID: S-1-5-21-1360995287-4027491577-3040029667-1156 Enabled: True Last Logon: Never Name: Perl, Alexandra M., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1160 Enabled: True Last Logon: 02/03/2025 10:53:32 [262 days] Name: Davis, Jason T., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1161 Enabled: True Last Logon: 01/28/2025 12:09:11 [268 days] Name: Long, Michael D., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1165 Enabled: True Last Logon: 08/18/2025 11:14:26 [66 days] Name: Arnold, Ryan W., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1172 Enabled: True Last Logon: 07/28/2025 00:23:29 [87 days] Name: Corachan, Steven, CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1173 Enabled: True Last Logon: 06/28/2025 15:04:47 [117 days] Name: user, test SID: S-1-5-21-1360995287-4027491577-3040029667-1230 Enabled: True Last Logon: 11/20/2024 15:06:00 [337 days] Name: Spain, Lance C., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1232 Enabled: True Last Logon: 04/25/2025 09:45:30 [181 days] Name: MSMEODUser SID: S-1-5-21-1360995287-4027491577-3040029667-1243 Enabled: True Last Logon: Never Name: User, Test C., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1245 Enabled: True Last Logon: 11/20/2024 15:17:52 [337 days] Name: Wright, Hayden V., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1248 Enabled: True Last Logon: 06/09/2025 18:13:25 [135 days] Name: Smith, Alexander D., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1249 Enabled: True Last Logon: 03/19/2025 13:41:00 [218 days] Name: Jones, Thomas L., Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1250 Enabled: True Last Logon: Never Name: Jones, Thomas SID: S-1-5-21-1360995287-4027491577-3040029667-1251 Enabled: True Last Logon: Never Name: Sanders, James R., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1253 Enabled: True Last Logon: 06/04/2025 14:16:14 [141 days] Name: Muchuslky, Joey SID: S-1-5-21-1360995287-4027491577-3040029667-1254 Enabled: True Last Logon: 06/04/2025 14:15:29 [141 days] Name: Monks, Paul J., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1255 Enabled: True Last Logon: 08/01/2025 19:55:03 [82 days] Name: Hershock, Patricia SID: S-1-5-21-1360995287-4027491577-3040029667-1256 Enabled: True Last Logon: 06/20/2025 11:05:07 [125 days] Name: Simon, Anthony E., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1260 Enabled: True Last Logon: 08/30/2025 12:53:38 [54 days] Name: Smith, Josh A., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1645 Enabled: True Last Logon: Never Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 4F0BBD6955A59F27ED6785FAFC2242904D0B130A ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-388225469-2825430915-2362864043-1000 Enabled: True Last Logon: 07/06/2023 06:02:53 [840 days] Comments documentation
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 091107231BDF2B3FD0B0E6F7E2EAB14E64D0DD9B ~~~~~ Failed accounts: --------------------- Name: DOD_Admin SID: S-1-5-21-3803552116-1809661109-1744339665-1000 Enabled: True Last Logon: 07/06/2023 06:02:49 [840 days] Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 94F81021CDE825A1A3D3D13E015DFD394B0EC37F ~~~~~ Ignored Accounts: --------------------- Name: X_Admin SID: S-1-5-21-4236012249-4164713760-2408648245-500 Enabled: True Last Logon: 05/12/2023 18:09:57 [894 days] No enabled accounts found that have not logged on within 35 days. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 864633688EF6E0F6669405CBD952738333EC0C8A ~~~~~ Ignored Accounts: --------------------- Name: X_Admin SID: S-1-5-21-2502410760-3344595884-382061215-500 Enabled: True Last Logon: 07/12/2023 16:38:51 [833 days] No enabled accounts found that have not logged on within 35 days. Comments

Check Text

Open "Windows PowerShell". Domain Controllers: Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. Member servers and standalone or nondomain-joined systems: Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.LastLogin.Value $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 if ($lastLogin -eq $null) { $lastLogin = 'Never' } Write-Host $user.Name $lastLogin $enabled }" This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). For example: User1 10/31/2015 5:49:56 AM True Review the list of accounts returned by the above queries to determine the finding validity for each account reported. Exclude the following accounts: - Built-in administrator account (Renamed, SID ending in 500) - Built-in guest account (Renamed, Disabled, SID ending in 501) - Built-in default account (Renamed, Disabled, SID ending in 503) - Application accounts If any enabled accounts have not been logged on to within the past 35 days, this is a finding. Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.

Fix Text

Regularly review accounts to determine if they are still active. Remove or disable accounts that have not been used in the last 35 days.

V-224824 CAT II Manually managed application account passwords must be chang...

8 assets 4 Open 1 Closed Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details No details recorded. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details No details recorded. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details No details recorded. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details No details recorded. Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details No details recorded. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details No details recorded. Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details No details recorded. Comments

Check Text

Determine if manually managed application/service accounts exist. If none exist, this is NA. If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. Identify manually managed application/service accounts. To determine the date a password was last changed: Domain controllers: Open "PowerShell". Enter "Get-AdUser -Identity [application account name] -Properties PasswordLastSet | FT Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. If the "PasswordLastSet" date is more than one year old, this is a finding. Member servers and standalone or nondomain-joined systems: Open "Command Prompt". Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. If the "Password Last Set" date is more than one year old, this is a finding.

Fix Text

Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization. It is recommended that system-managed service accounts be used whenever possible.

V-224839 CAT II Passwords must be configured to expire.

8 assets 3 Open 5 Closed Documented Pending Review Microsoft Windows Se...

Hostname	IP Address	Last Scan
MONT-AP-002	164.231.187.39	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 03421DBAA63FB77EFDA8438D19174504036DC035 ~~~~~ No enabled accounts found where the password does not expire. Comments
MONT-BE-002	164.231.187.37	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 03421DBAA63FB77EFDA8438D19174504036DC035 ~~~~~ No enabled accounts found where the password does not expire. Comments
MONT-DB-002	164.231.187.38	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 03421DBAA63FB77EFDA8438D19174504036DC035 ~~~~~ No enabled accounts found where the password does not expire. Comments
MONT-DC-003	164.231.187.34	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 5FA70E953F12D3C0AF507422C3B9826225B21F81 ~~~~~ Failed accounts: --------------------- Name: D.Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1104 Enabled: True Password Expires: False Name: S.Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1105 Enabled: True Password Expires: False Name: W.Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1106 Enabled: True Password Expires: False Name: Exchange Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1118 Enabled: True Password Expires: False Name: HealthMailbox03020cb359cd4879a5fd73f010bde991 SID: S-1-5-21-1360995287-4027491577-3040029667-1605 Enabled: True Password Expires: False Name: HealthMailbox3295a98105294ef195ff4f5394ae0e3c SID: S-1-5-21-1360995287-4027491577-3040029667-1606 Enabled: True Password Expires: False Name: HealthMailbox8d8eb4c107e64340876668cde6c1289e SID: S-1-5-21-1360995287-4027491577-3040029667-1607 Enabled: True Password Expires: False Name: HealthMailboxfd82eb3f816c4428bcc7a1706f017682 SID: S-1-5-21-1360995287-4027491577-3040029667-1608 Enabled: True Password Expires: False Name: HealthMailbox4ffeb90d1e3e42808987669877a590dc SID: S-1-5-21-1360995287-4027491577-3040029667-1150 Enabled: True Password Expires: False Name: HealthMailboxa7603ef65a894a7abd37cc7afcd0498f SID: S-1-5-21-1360995287-4027491577-3040029667-1609 Enabled: True Password Expires: False Name: HealthMailbox0045b0edfe864ade8de6332392102884 SID: S-1-5-21-1360995287-4027491577-3040029667-1151 Enabled: True Password Expires: False Name: HealthMailbox2a4e029adc2c45d7a2377f21fc959267 SID: S-1-5-21-1360995287-4027491577-3040029667-1610 Enabled: True Password Expires: False Name: HealthMailboxff1c61cd50724325bd1467262f3ab3f7 SID: S-1-5-21-1360995287-4027491577-3040029667-1611 Enabled: True Password Expires: False Name: HealthMailbox476aa3607f714413bb95f561ccbef1c1 SID: S-1-5-21-1360995287-4027491577-3040029667-1152 Enabled: True Password Expires: False Name: HealthMailboxa75cf849d12c447fb0c70e70b866e36e SID: S-1-5-21-1360995287-4027491577-3040029667-1612 Enabled: True Password Expires: False Name: Backup SID: S-1-5-21-1360995287-4027491577-3040029667-1614 Enabled: True Password Expires: False Name: Scan Admin SID: S-1-5-21-1360995287-4027491577-3040029667-1192 Enabled: True Password Expires: False Name: FIM, ANOC SID: S-1-5-21-1360995287-4027491577-3040029667-1203 Enabled: True Password Expires: False Name: IA ADMIN, JTBegarek SID: S-1-5-21-1360995287-4027491577-3040029667-1212 Enabled: True Password Expires: False Name: user, test SID: S-1-5-21-1360995287-4027491577-3040029667-1230 Enabled: True Password Expires: False Name: Gonzalez, Ian W., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1242 Enabled: True Password Expires: False Name: MSMEODUser SID: S-1-5-21-1360995287-4027491577-3040029667-1243 Enabled: True Password Expires: False Name: User, Test C., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1245 Enabled: True Password Expires: False Name: Jones, Thomas SID: S-1-5-21-1360995287-4027491577-3040029667-1251 Enabled: True Password Expires: False Name: Sanders, James R., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1253 Enabled: True Password Expires: False Name: Muchuslky, Joey SID: S-1-5-21-1360995287-4027491577-3040029667-1254 Enabled: True Password Expires: False Name: Begarek, Justin T., CIV SID: S-1-5-21-1360995287-4027491577-3040029667-1263 Enabled: True Password Expires: False Name: Smith, Josh A., CTR SID: S-1-5-21-1360995287-4027491577-3040029667-1645 Enabled: True Password Expires: False Comments
MONT-DP-001	164.231.187.44	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 03421DBAA63FB77EFDA8438D19174504036DC035 ~~~~~ No enabled accounts found where the password does not expire. Comments
MONT-MB-002	164.231.187.36	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 03421DBAA63FB77EFDA8438D19174504036DC035 ~~~~~ No enabled accounts found where the password does not expire. Comments
MONT-VSF-003	164.231.187.42	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 3D09A3C4DEBAC2BE19C65EFA1252FC4A3C76F126 ~~~~~ Failed accounts: --------------------- Name: dod_admin SID: S-1-5-21-4236012249-4164713760-2408648245-1000 Enabled: True Password Expires: False Comments
MONT-VSF-004	164.231.187.43	2026-01-14
Finding Details Evaluate-STIG 1.2507.5 (Scan-WindowsServer2016_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: DBB32C5EBBE5AA7AAF75394A6C8D8B4782E1A1A7 ~~~~~ Failed accounts: --------------------- Name: dod_admin SID: S-1-5-21-2502410760-3344595884-382061215-1000 Enabled: True Password Expires: False Comments

Check Text

Review the password never expires status for enabled user accounts. Open "PowerShell". Domain Controllers: Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | FT Name, PasswordNeverExpires, Enabled". Exclude application accounts, disabled accounts (e.g., DefaultAccount, Guest), and the krbtgt account. If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. Member servers and standalone or nondomain-joined systems: Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. Exclude application accounts and disabled accounts (e.g., DefaultAccount, Guest). If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding.

Fix Text

Configure all enabled user account passwords to expire. Uncheck "Password never expires" for all enabled user accounts in Active Directory Users and Computers for domain accounts and Users in Computer Management for member servers and standalone or nondomain-joined systems. Document any exceptions with the ISSO.

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Check Text

Fix Text

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments

Finding Details

Comments