STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

WINS lookups must be disabled on the Windows DNS Server.

DISA Rule

SV-259377r961581_rule

Vulnerability Number

V-259377

Group Title

SRG-APP-000422-DNS-000055

Rule Version

WDNS-22-000049

Severity

CAT II

CCI(s)

• CCI-002462 - Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.

Weight

10

Fix Recommendation

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, right-click each zone and then click "Properties".

In the "Properties" dialog box for the zone, click the "WINS" tab.

Uncheck the "Use WINS forward" lookup check box.

Click "OK".

Check Contents

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, right-click each zone and then click "Properties".

In the "Properties" dialog box for the zone, click the "WINS" tab.

Verify the "Use WINS forward lookup" check box is not selected.

If the "Use WINS forward lookup" check box is selected, this is a finding.

Vulnerability Number

V-259377

Documentable

False

Rule Version

WDNS-22-000049

Severity Override Guidance

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, right-click each zone and then click "Properties".

In the "Properties" dialog box for the zone, click the "WINS" tab.

Verify the "Use WINS forward lookup" check box is not selected.

If the "Use WINS forward lookup" check box is selected, this is a finding.

Check Content Reference

M

Target Key

5576