STIGQter: STIG Summary: Microsoft Windows 11 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

Windows Ink Workspace must be configured to disallow access above the lock.

DISA Rule

SV-253424r1210299_rule

Vulnerability Number

V-253424

Group Title

SRG-OS-000031-GPOS-00012

Rule Version

WN11-CC-000385

Severity

CAT II

CCI(s)

• CCI-000060 - Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Weight

10

Fix Recommendation

Disable the convenience PIN sign-in.

For GPO-managed systems:

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace >> Set "Allow Windows Ink Workspace" to "Enabled and set Options On, but disallow access above lock".

For Intune-managed systems:

Set the Windows Ink Workspace Policy to disallow access above lock.

Check Contents

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\WindowsInkWorkspace (For GPO-managed systems)
Or
Registry Path: \SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace (For Intune-managed systems)

Value Name: AllowWindowsInkWorkspace
Value Type: REG_DWORD
Value data: 1

Vulnerability Number

V-253424

Documentable

False

Rule Version

WN11-CC-000385

Severity Override Guidance

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\WindowsInkWorkspace (For GPO-managed systems)
Or
Registry Path: \SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace (For Intune-managed systems)

Value Name: AllowWindowsInkWorkspace
Value Type: REG_DWORD
Value data: 1

Check Content Reference

M

Target Key

5471