STIGQter: STIG Summary: Microsoft Windows 11 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

Windows 11 must be configured to require a minimum PIN length of six characters or greater.

DISA Rule

SV-253401r1210296_rule

Vulnerability Number

V-253401

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

WN11-CC-000260

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

For GPO-managed systems:

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> "Minimum PIN length" to "6" or greater.

For Intune-managed systems:

Revise the Intune policy to set the minimum PIN length to "6" or greater.

Check Contents

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity\ (For GPO-managed systems)
Or
Registry Path: \SOFTWARE\Microsoft\Policies\PassportForWork\[guid]\device\policies\PINComplexity (For Intune-managed systems)

Value Name: MinimumPINLength

Type: REG_DWORD
Value: 6 (or greater)

Vulnerability Number

V-253401

Documentable

False

Rule Version

WN11-CC-000260

Severity Override Guidance

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity\ (For GPO-managed systems)
Or
Registry Path: \SOFTWARE\Microsoft\Policies\PassportForWork\[guid]\device\policies\PINComplexity (For Intune-managed systems)

Value Name: MinimumPINLength

Type: REG_DWORD
Value: 6 (or greater)

Check Content Reference

M

Target Key

5471