STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.

DISA Rule

SV-278178r1182282_rule

Vulnerability Number

V-278178

Group Title

SRG-OS-000134-GPOS-00068

Rule Version

WN25-MS-000020

Severity

CAT II

CCI(s)

• CCI-001084 - Isolate security functions from nonsecurity functions.

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> Apply UAC restrictions to local accounts on network logons to "Enabled".

This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and " SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

Check Contents

This applies to member servers. For domain controllers and stand-alone or nondomain-joined systems, this is not applicable.

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry HiveHKEY_LOCAL_MACHINE
Registry Path\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Value NameLocalAccountTokenFilterPolicy

TypeREG_DWORD
Value: 0x00000000 (0)

This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans must use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to "1" may be required.

Vulnerability Number

V-278178

Documentable

False

Rule Version

WN25-MS-000020

Severity Override Guidance

This applies to member servers. For domain controllers and stand-alone or nondomain-joined systems, this is not applicable.

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry HiveHKEY_LOCAL_MACHINE
Registry Path\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Value NameLocalAccountTokenFilterPolicy

TypeREG_DWORD
Value: 0x00000000 (0)

This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans must use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to "1" may be required.

Check Content Reference

M

Target Key

5719