STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 domain Controller PKI certificates must be issued by the DOD PKI or an approved External Certificate Authority (ECA).

DISA Rule

SV-278160r1182126_rule

Vulnerability Number

V-278160

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

WN25-DC-000290

Severity

CAT I

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Obtain a server certificate for the domain controller issued by the DOD PKI or an approved ECA.

Check Contents

This applies to domain controllers. It is not applicable for other systems.

Run "MMC".

Select "Add/Remove Snap-in" from the "File" menu.

Select "Certificates" in the left pane, and then click "Add >".

Select "Computer Account", and then click "Next".

Select the appropriate option for "Select the computer you want this snap-in to manage", and then click "Finish".

Click "OK".

Select and expand the "Certificates (Local Computer)" entry in the left pane.

Select and expand the "Personal" entry in the left pane.

Select the "Certificates" entry in the left pane.

In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA.

If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DOD PKI or an approved ECA, this is a finding.

If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding.

There are multiple sources from which lists of valid DOD CAs and approved ECAs can be obtained:

The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil.

DOD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DOD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on Cyber Exchange:
https://www.cyber.mil/pki-pke/tools-configuration-files

Vulnerability Number

V-278160

Documentable

False

Rule Version

WN25-DC-000290

Severity Override Guidance

This applies to domain controllers. It is not applicable for other systems.

Run "MMC".

Select "Add/Remove Snap-in" from the "File" menu.

Select "Certificates" in the left pane, and then click "Add >".

Select "Computer Account", and then click "Next".

Select the appropriate option for "Select the computer you want this snap-in to manage", and then click "Finish".

Click "OK".

Select and expand the "Certificates (Local Computer)" entry in the left pane.

Select and expand the "Personal" entry in the left pane.

Select the "Certificates" entry in the left pane.

In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA.

If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DOD PKI or an approved ECA, this is a finding.

If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding.

There are multiple sources from which lists of valid DOD CAs and approved ECAs can be obtained:

The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil.

DOD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DOD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on Cyber Exchange:
https://www.cyber.mil/pki-pke/tools-configuration-files

Check Content Reference

M

Target Key

5719