← Back to Microsoft Windows 11 Security Technical Implementation Guide

V-268318

CAT II (Medium)

Windows 11 systems must use either Group Policy or an approved Mobile Device Management (MDM) product to enforce STIG compliance.

Rule ID

SV-268318r1135322_rule

STIG

Microsoft Windows 11 Security Technical Implementation Guide

Version

V2R7

CCIs

CCI-000366

Discussion

Without Windows 11 systems being managed, devices could be rogue and become targets of an attacker.

Check Content

Verify the Windows 11 system is receiving policy from either group Policy or an MDM with the following steps:

From a command line or PowerShell:

gpresult /R
OS Configuration: Member Workstation

If the system is not being managed by GPO, ask the administrator to indicate which MDM is managing the device.

From PowerShell: Get-Service -Name "IntuneManagementExtension"

If the Windows 11 system is not receiving policy from either group Policy or an MDM, this is a finding.

This is NA for standalone, nondomain-joined systems.

Fix Text

Configure the Windows 11 system to use either Group Policy or an approved MDM product to enforce STIG compliance.