OpenControls Logo

STIG Viewer

STIGViewer Support

The Windows PAW must be configured to enforce two-factor authentication and use Active Directory for authentication management.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-243457WPAW-00-001600SV-243457r1015765_ruleCCI-000765medium
Description
Due to the highly privileged functions of a PAW, a high level of trust must be implemented for access to the PAW, including nonrepudiation of the user session. One-factor authentication, including username and password and shared administrator accounts, does not provide adequate assurance.
STIGDate
Microsoft Windows PAW Security Technical Implementation Guide2025-05-23

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-06Multi-Factor Authentication (MFA)
0.50
IAC-06.1Network Access to Privileged Accounts
0.50
IAC-06.2Network Access to Non-Privileged Accounts
0.50
IAC-06.3Local Access to Privileged Accounts
0.50
IAC-06.4Out-of-Band Multi-Factor Authentication
0.50
IAC-10.7Hardware Token-Based Authentication
0.50
TDA-02.2Information Assurance Enabled Products
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (68) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00

+58 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.5.3
1.00
CCI2 mappings
CCI-000765
1.00
CCI-000767
1.00

Details

Check Text (C-243457r1015765_chk)

Review the configuration on the PAW. Verify group policy is configured to enable either smart card or another DOD-approved two-factor authentication method for site PAWs. - In Active Directory, go to Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - Verify "Interactive logon: Require Windows Hello for Business or smart card" is set to "Enabled". If group policy is not configured to enable either smart card or another DOD-approved two-factor authentication method, this is a finding.

Fix Text (F-46689r997926_fix)

In Active Directory, configure group policy to enable either smart card or another DOD-approved two-factor authentication method for all PAWs. - Go to Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - Set "Interactive logon: Require Windows Hello for Business or smart card" to "Enabled".