STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 must have the DOD Root Certificate Authority (CA) certificates installed in the Trusted Root Store.

DISA Rule

SV-278192r1212173_rule

Vulnerability Number

V-278192

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

WN25-PK-000010

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.
• CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Weight

10

Fix Recommendation

Install the DOD Root CA certificates:

DOD Root CA 3

DOD Root CA 5

DOD Root CA 6

The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files.

Check Contents

The certificates and thumbprints referenced below apply to unclassified systems. Refer to the PKE documentation for other networks.

Open PowerShell as an administrator.

Execute the following command:

Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DOD*" | FL Subject, NotAfter

If valid (unexpired) DOD Root CA certificates (such as those below) are not listed, this is a finding.

Note: The Common Names (CN) below are examples. Verify that the "CN" displayed is a DOD Root CA and is not expired.

Subject: CN=DOD Root CA 3, OU=PKI, OU=DOD, O=U.S. Government, C=US
NotAfter: 12/30/2029

Subject: CN=DOD Root CA 5, OU=PKI, OU=DOD, O=U.S. Government, C=US
NotAfter: 6/14/2041

Subject: CN=DOD Root CA 6, OU=PKI, OU=DOD, O=U.S. Government, C=US
NotAfter: 1/24/2053

Alternately, use the Certificates MMC snap-in:

Run "MMC".

Select "File", "Add/Remove Snap-in".

Select "Certificates" and click "Add".

Select "Computer account" and click "Next".

Select "Local computer: (the computer this console is running on)" and click "Finish".

Click "OK".

Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates".

For each of the DOD Root CA certificates noted below:

Right-click the certificate and select "Open".

Select the "Details" tab.

Verify that expiration date is in the future.

If valid (unexpired) DOD Root CA certificates (such as those below) are not listed, this is a finding.

DOD Root CA 3

DOD Root CA 5

DOD Root CA 6

Vulnerability Number

V-278192

Documentable

False

Rule Version

WN25-PK-000010

Severity Override Guidance

The certificates and thumbprints referenced below apply to unclassified systems. Refer to the PKE documentation for other networks.

Open PowerShell as an administrator.

Execute the following command:

Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DOD*" | FL Subject, NotAfter

If valid (unexpired) DOD Root CA certificates (such as those below) are not listed, this is a finding.

Note: The Common Names (CN) below are examples. Verify that the "CN" displayed is a DOD Root CA and is not expired.

Subject: CN=DOD Root CA 3, OU=PKI, OU=DOD, O=U.S. Government, C=US
NotAfter: 12/30/2029

Subject: CN=DOD Root CA 5, OU=PKI, OU=DOD, O=U.S. Government, C=US
NotAfter: 6/14/2041

Subject: CN=DOD Root CA 6, OU=PKI, OU=DOD, O=U.S. Government, C=US
NotAfter: 1/24/2053

Alternately, use the Certificates MMC snap-in:

Run "MMC".

Select "File", "Add/Remove Snap-in".

Select "Certificates" and click "Add".

Select "Computer account" and click "Next".

Select "Local computer: (the computer this console is running on)" and click "Finish".

Click "OK".

Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates".

For each of the DOD Root CA certificates noted below:

Right-click the certificate and select "Open".

Select the "Details" tab.

Verify that expiration date is in the future.

If valid (unexpired) DOD Root CA certificates (such as those below) are not listed, this is a finding.

DOD Root CA 3

DOD Root CA 5

DOD Root CA 6

Check Content Reference

M

Target Key

5719