OpenControls Logo

STIG Viewer

STIGViewer Support

Windows Ink Workspace must be configured to disallow access above the lock.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253424WN11-CC-000385SV-253424r1210299_ruleCCI-000060medium
Description
This action secures Windows Ink, which contains applications and features oriented toward pen computing. Note: A different registry location is needed when systems are managed by Intune versus GPO.
STIGDate
Microsoft Windows 11 Security Technical Implementation Guide2026-05-19

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24.1Pattern-Hiding Displays
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (15) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AU-10Non-repudiation
1.00
IA-11Re-authentication
1.00
IA-2Identification and Authentication (Organizational Users)
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00
IA-2(2)Multi-factor Authentication to Non-privileged Accounts
1.00
IA-2(3)Local Access to Privileged Accounts
1.00

+5 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10
1.00
CCI1 mapping
CCI-000060
1.00

Details

Check Text (C-253424r1210299_chk)

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\WindowsInkWorkspace (For GPO-managed systems) Or Registry Path: \SOFTWARE\Microsoft\PolicyManager\current\device\WindowsInkWorkspace (For Intune-managed systems) Value Name: AllowWindowsInkWorkspace Value Type: REG_DWORD Value data: 1

Fix Text (F-56827r1210228_fix)

Disable the convenience PIN sign-in. For GPO-managed systems: Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace >> Set "Allow Windows Ink Workspace" to "Enabled and set Options On, but disallow access above lock". For Intune-managed systems: Set the Windows Ink Workspace Policy to disallow access above lock.