U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Microsoft Windows Server 2022 Ver 2, Rel 8 Checklist Details (Checklist Revisions)

SCAP 1.3 Content:

Supporting Resources:

  • Download Standalone XCCDF 1.1.4 - Windows Server 2022 STIG with Ansible - Ver 1, Rel 1
    • Defense Information Systems Agency
  • Download Standalone XCCDF 1.1.4 - Microsoft Windows Server 2022 STIG for Chef - Ver 1, Rel 1
    • Defense Information Systems Agency
  • Download Standalone XCCDF 1.1.4 - Microsoft Windows Server 2022 STIG - Ver 2, Rel 8
    • Defense Information Systems Agency
  • Download GPOs - Group Policy Objects (GPOs) - January 2026
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
  • Download Automated Content - SCC 5.14 Windows
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency
    • Defense Information Systems Agency

Target:

Target CPE Name
Microsoft Windows Server 2022 cpe:/o:microsoft:windows_server_2022:- (View CVEs)

Checklist Highlights

Checklist Name:
Microsoft Windows Server 2022
Checklist ID:
1034
Version:
Ver 2, Rel 8
Type:
Compliance
Review Status:
Final
Authority:
Governmental Authority: Defense Information Systems Agency
Original Publication Date:
10/06/2022

Checklist Summary:

The Microsoft Windows Server 2022 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements were developed by DOD Consensus as well as Windows security guidance by Microsoft Corporation. This document is meant for use in conjunction with other applicable STIGs including such topics as Active Directory Domain, Active Directory Forest, and Domain Name Service (DNS). The Windows Server 2022 STIG includes requirements for both domain controllers and member servers/standalone systems. Requirements specific to domain controllers have “DC” as the second component of the STIG IDs. Requirements specific to member servers have “MS” as the second component of the STIG IDs. All other requirements apply to all systems.

Checklist Role:

  • Server

Known Issues:

Not provided.

Target Audience:

Not provided.

Target Operational Environment:

  • Managed
  • Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoD Instruction (DoDI) 8500.01

Comments/Warnings/Miscellaneous:

Comments or proposed revisions to this document should be sent via email to the following address: [email protected]. DISA will coordinate all change requests with the relevant DOD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Disclaimer:

Not provided.

Product Support:

Not provided.

Point of Contact:

[email protected]

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:



					

Dependency/Requirements:

URL Description

References:

Reference URL Description

NIST checklist record last modified on 02/13/2026