STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 PKI certificates associated with user accounts must be issued by a DOD PKI or an approved External Certificate Authority (ECA).

DISA Rule

SV-278161r1182128_rule

Vulnerability Number

V-278161

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

WN25-DC-000300

Severity

CAT I

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Map user accounts to PKI certificates using the appropriate UPN for the network. Refer to the PKE documentation for details.

Check Contents

This applies to domain controllers. It is not applicable for other systems.

Review user account mappings to PKI certificates.

Open PowerShell.

Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled".

Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account.

If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding.

For standard NIPRNet certificates, the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI).

Alt Tokens and other certificates may use a different UPN format than the EDI-PI, which vary by organization. Verified these with the organization.

NIPRNet example:

Name - User Principal Name
User1 - 1234567890@mil

Refer to the PKE documentation for other network domain suffixes.

If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding.

Vulnerability Number

V-278161

Documentable

False

Rule Version

WN25-DC-000300

Severity Override Guidance

This applies to domain controllers. It is not applicable for other systems.

Review user account mappings to PKI certificates.

Open PowerShell.

Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled".

Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account.

If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding.

For standard NIPRNet certificates, the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI).

Alt Tokens and other certificates may use a different UPN format than the EDI-PI, which vary by organization. Verified these with the organization.

NIPRNet example:

Name - User Principal Name
User1 - 1234567890@mil

Refer to the PKE documentation for other network domain suffixes.

If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding.

Check Content Reference

M

Target Key

5719