STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 shared user accounts must not be permitted.

DISA Rule

SV-277991r1181778_rule

Vulnerability Number

V-277991

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

WN25-00-000070

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Remove unapproved shared accounts from the system.

Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.

Check Contents

Determine whether any shared accounts exist. If no shared accounts exist, this is not applicable.

Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the information system security officer (ISSO). Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.

If unapproved shared accounts exist, this is a finding.

Vulnerability Number

V-277991

Documentable

False

Rule Version

WN25-00-000070

Severity Override Guidance

Determine whether any shared accounts exist. If no shared accounts exist, this is not applicable.

Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the information system security officer (ISSO). Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.

If unapproved shared accounts exist, this is a finding.

Check Content Reference

M

Target Key

5719