STIGQter: STIG Summary: Microsoft Windows Server 2022 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Windows Server 2022 must use an antivirus program.

DISA Rule

SV-254248r991589_rule

Vulnerability Number

V-254248

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

WN22-00-000110

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

If no antivirus software is in use, install Microsoft Defender or third-party antivirus.

Open "PowerShell".

Enter "Install-WindowsFeature -Name Windows-Defender".

For third-party antivirus, install per antivirus instructions and disable Windows Defender.

Open "PowerShell".

Enter "Uninstall-WindowsFeature -Name Windows-Defender".

Check Contents

Verify an antivirus solution is installed on the system. The antivirus solution may be bundled with an approved host-based security solution.

If there is no antivirus solution installed on the system, this is a finding.

Verify if Microsoft Defender antivirus is in use or enabled:

Open "PowerShell".

Enter "get-service | where {$_.DisplayName -Like "*Defender*"} | Select Status,DisplayName"

Verify if third-party antivirus is in use or enabled:

Open "PowerShell".

Enter "get-service | where {$_.DisplayName -Like "*mcafee*"} | Select Status,DisplayName

Enter "get-service | where {$_.DisplayName -Like "*symantec*"} | Select Status,DisplayName

Vulnerability Number

V-254248

Documentable

False

Rule Version

WN22-00-000110

Severity Override Guidance

Verify an antivirus solution is installed on the system. The antivirus solution may be bundled with an approved host-based security solution.

If there is no antivirus solution installed on the system, this is a finding.

Verify if Microsoft Defender antivirus is in use or enabled:

Open "PowerShell".

Enter "get-service | where {$_.DisplayName -Like "*Defender*"} | Select Status,DisplayName"

Verify if third-party antivirus is in use or enabled:

Open "PowerShell".

Enter "get-service | where {$_.DisplayName -Like "*mcafee*"} | Select Status,DisplayName

Enter "get-service | where {$_.DisplayName -Like "*symantec*"} | Select Status,DisplayName

Check Content Reference

M

Target Key

5485