UCF STIG Viewer Logo

Windows 11 nonpersistent VM sessions must not exceed 24 hours.


Finding ID Version Rule ID IA Controls Severity
V-253295 WN11-00-000250 SV-253295r890452_rule Medium
For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization must enforce that sessions be terminated within 24 hours. This would ensure any data stored on the VM that is not encrypted or covered by Credential Guard is deleted.
Microsoft Windows 11 Security Technical Implementation Guide 2023-09-29


Check Text ( C-56748r890450_chk )
Verify there is a documented policy or procedure in place that nonpersistent VM sessions do not exceed 24 hours.

If the system is NOT a nonpersistent VM, this is Not Applicable.

For Azure Virtual Desktop (AVD) implementations with no data at rest, this is Not Applicable.

If there is no such documented policy or procedure in place, this is a finding.
Fix Text (F-56698r890451_fix)
Set nonpersistent VM sessions to not exceed 24 hours.