OpenControls Logo

STIG Viewer

STIGViewer Support

Windows 11 must be configured to prevent Windows apps from being activated by voice while the system is locked.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253422WN11-CC-000365SV-253422r1210298_ruleCCI-000056medium
Description
Allowing Windows apps to be activated by voice from the lock screen could allow for unauthorized use. Requiring logon will ensure the apps are used only by authorized personnel. Note: A different registry location is needed when systems are managed by Intune versus GPO.
STIGDate
Microsoft Windows 11 Security Technical Implementation Guide2026-05-19

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24Session Lock
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (15) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AU-10Non-repudiation
1.00
IA-2Identification and Authentication (Organizational Users)
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00
IA-2(2)Multi-factor Authentication to Non-privileged Accounts
1.00
IA-2(3)Local Access to Privileged Accounts
1.00
IA-2(4)Local Access to Non-privileged Accounts
1.00

+5 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10
1.00
CCI1 mapping
CCI-000056
1.00

Details

Check Text (C-253422r1210298_chk)

The setting is NA when the "Allow voice activation" policy is configured to disallow applications to be activated with voice for all users. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\ (For GPO-managed systems) Or Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy!LetAppsActivateWithVoice (For Intune-managed systems) Value Name: LetAppsActivateWithVoiceAboveLock Type: REG_DWORD Value: 0x00000002 (2) If the following registry value exists and is configured as specified, the requirement is NA: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\ (For GPO-managed systems) Or Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy!LetAppsActivateWithVoiceAboveLock (For Intune-managed systems) Value Name: LetAppsActivateWithVoice Type: REG_DWORD Value: 0x00000002 (2)

Fix Text (F-56825r1210225_fix)

For GPO-managed systems: Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice while the system is locked" to "Enabled" with Default for all Apps: set to Force Deny. The requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice" is configured to "Enabled" with Default for all Apps: set to Force Deny. For Intune-managed systems: Revise the Intune App Privacy policy to deny voice activation of Windows apps while the system is locked.