STIGQter STIGQter: STIG Summary: Microsoft Windows 11 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

Windows 11 systems must use either Group Policy or an approved Mobile Device Management (MDM) product to enforce STIG compliance.

DISA Rule

SV-268318r1210288_rule

Vulnerability Number

V-268318

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

WN11-CC-000063

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Windows 11 system to use either Group Policy or an approved MDM product to enforce STIG compliance.

Check Contents

Verify the Windows 11 system is receiving policy from either group Policy or an MDM with the following steps:

From a command line or PowerShell:

gpresult /R
OS Configuration: Member Workstation

If the system OS Configuration is set to "Member Workstation", the system is being managed by GPO.

If the system OS Configuration is set to "Standalone Workstation" and is not being managed by GPO, ask the administrator to indicate which MDM is managing the device.

Issue to the following for Intune. Note: Intune must be running at time of command.

From PowerShell: Get-Service -Name "IntuneManagementExtension"

This should return the following result:

Status = Running, Name = IntuneManagementExtension, DisplayName = Microsoft Intune Management Extension

If Intune is not installed, the response will include "ObjectNotFound" and/or "NoServiceFoundForGivenName".

If the Windows 11 system is not receiving policy from either group Policy or an MDM (that is running), this is a finding.

Vulnerability Number

V-268318

Documentable

False

Rule Version

WN11-CC-000063

Severity Override Guidance

Verify the Windows 11 system is receiving policy from either group Policy or an MDM with the following steps:

From a command line or PowerShell:

gpresult /R
OS Configuration: Member Workstation

If the system OS Configuration is set to "Member Workstation", the system is being managed by GPO.

If the system OS Configuration is set to "Standalone Workstation" and is not being managed by GPO, ask the administrator to indicate which MDM is managing the device.

Issue to the following for Intune. Note: Intune must be running at time of command.

From PowerShell: Get-Service -Name "IntuneManagementExtension"

This should return the following result:

Status = Running, Name = IntuneManagementExtension, DisplayName = Microsoft Intune Management Extension

If Intune is not installed, the response will include "ObjectNotFound" and/or "NoServiceFoundForGivenName".

If the Windows 11 system is not receiving policy from either group Policy or an MDM (that is running), this is a finding.

Check Content Reference

M

Target Key

5471