OpenControls Logo

STIG Viewer

STIGViewer Support

The Windows Server 2025 "Modify firmware environment values" user right must only be assigned to the Administrators group.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-278258WN25-UR-000180SV-278258r1182226_ruleCCI-002235medium
Description
Inappropriately granting user rights provides system, administrative, and other high-level capabilities. Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a denial of service.
STIGDate
Microsoft Windows Server 2025 Security Technical Implementation Guide2026-02-20

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.5Prohibit Non-Privileged Users from Executing Privileged Functions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (50) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+40 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.7
1.00
CCI1 mapping
CCI-002235
1.00

Details

Check Text (C-278258r1182226_chk)

Verify the effective setting in Local Group Policy Editor. Run gpedit.msc. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: - Administrators. For server core installations, run the following command: Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt Review the text file. If any SIDs other than the following are granted the "SeSystemEnvironmentPrivilege" user right, this is a finding: S-1-5-32-544 (Administrators)

Fix Text (F-82693r1181905_fix)

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> Modify firmware environment values to include only the following accounts or groups: - Administrators.