UCF STIG Viewer Logo

Automatic Updates must not be used (unless configured to point to a DoD server).


Overview

Finding ID Version Rule ID IA Controls Severity
V-14250 2.119 SV-25200r2_rule DCSL-1 Medium
Description
Uncontrolled system updates can introduce issues to a system. The system must be configured to prevent Automatic Updates from being run unless directed to a DoD Windows Server Update Services (WSUS) server.
STIG Date
Windows 7 Security Technical Implementation Guide 2013-10-01

Details

Check Text ( C-45635r1_chk )
If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \Software\Policies\Microsoft\Windows\WindowsUpdate\AU\

Value Name: NoAutoUpdate

Type: REG_DWORD
Value: 1

If the site is using a DoD WSUS server to distribute software updates, and the computer is configured to point at that server, this can be set to "Enabled". In this instance, the setting will not be considered a finding.
To determine whether WSUS is being used, verify the following registry key value exists and is pointing to an organizational or DoD WSUS URL.

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \Software\Policies\Microsoft\Windows\WindowsUpdate\

Value Name: WUServer

Type: REG_SZ
Value: "URL of DoD WSUS"
Fix Text (F-42650r1_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Configure Automatic Updates" to "Disabled".

If the site is using a DoD WSUS server to distribute software updates, the policy setting to configure the WSUS URL is Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Specify intranet Microsoft update service location".