STIGQter STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 Active Directory Group Policy Objects (GPOs) must be configured with proper audit settings.

DISA Rule

SV-278148r1192632_rule

Vulnerability Number

V-278148

Group Title

SRG-OS-000327-GPOS-00127

Rule Version

WN25-DC-000170

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the audit settings for GPOs to include the following:

This can be done at the Policy level in AD to apply to all group policies.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Select "Advanced Features" from the "View" menu.

Navigate to [Domain] >> System >> Policies in the left panel.

Right-click "Policies", and then select "Properties".

Select the "Security" tab.

Select "Advanced".

Select the "Auditing" tab.

Type - Fail
Principal - Everyone
Access - Full Control
Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects

The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference.

Type - Success
Principal - Everyone
Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected)
Inherited from - Parent Object
Applies to - Descendant groupPolicyContainer objects

Two instances with the following summary information will be listed:

Type - Success
Principal - Everyone
Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions)
Inherited from - Parent Object
Applies to - Descendant Organization Unit Objects

Check Contents

This applies to domain controllers. It is not applicable for other systems.

Review the auditing configuration for all GPOs.

Open "Group Policy Management" (available from various menus or run "gpmc.msc").

Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain).

For each GPO:

Select the GPO item in the left pane.

Select the "Delegation" tab in the right pane.

Select "Advanced".

Select "Advanced", and then select the "Auditing" tab.

If the audit settings for any GPO are not at least as inclusive as those below, this is a finding:

Type - Fail
Principal - Everyone
Access - Full Control
Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects

The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference.

Type - Success
Principal - Everyone
Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected)
Inherited from - Parent Object
Applies to - Descendant groupPolicyContainer objects

Two instances with the following summary information will be listed:

Type - Success
Principal - Everyone
Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions)
Inherited from - Parent Object
Applies to - Descendant Organization Unit Objects

Vulnerability Number

V-278148

Documentable

False

Rule Version

WN25-DC-000170

Severity Override Guidance

This applies to domain controllers. It is not applicable for other systems.

Review the auditing configuration for all GPOs.

Open "Group Policy Management" (available from various menus or run "gpmc.msc").

Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain).

For each GPO:

Select the GPO item in the left pane.

Select the "Delegation" tab in the right pane.

Select "Advanced".

Select "Advanced", and then select the "Auditing" tab.

If the audit settings for any GPO are not at least as inclusive as those below, this is a finding:

Type - Fail
Principal - Everyone
Access - Full Control
Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects

The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference.

Type - Success
Principal - Everyone
Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected)
Inherited from - Parent Object
Applies to - Descendant groupPolicyContainer objects

Two instances with the following summary information will be listed:

Type - Success
Principal - Everyone
Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions)
Inherited from - Parent Object
Applies to - Descendant Organization Unit Objects

Check Content Reference

M

Target Key

5719