Automatic Updates must not be used (unless configured to point to a DoD server).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14250	WN12-CC-000129	SV-52985r1_rule	DCSL-1	Medium

Description
Uncontrolled system updates can introduce issues to a system. The system must be configured to prevent Automatic Updates from being run unless directed to a DoD Windows Server Update Services (WSUS) server.

STIG	Date
Windows Server 2012 / 2012 R2 Domain Controller Security Technical Implementation Guide	2014-12-18

Details

Check Text ( C-47291r3_chk )
If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows\WindowsUpdate\AU\ Value Name: NoAutoUpdate Type: REG_DWORD Value: 1 If the site is using a DoD WSUS server to distribute software updates, and the computer is configured to point at that server, this can be set to "Enabled". In this instance, the setting will not be considered a finding. To determine whether WSUS is being used, verify the following registry key value exists and is pointing to an organizational or DoD WSUS URL: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows\WindowsUpdate\ Value Name: WUServer Type: REG_SZ Value: "URL of DoD WSUS"

Check Text ( C-47291r3_chk )

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Policies\Microsoft\Windows\WindowsUpdate\AU\

Value Name: NoAutoUpdate

Type: REG_DWORD
Value: 1

If the site is using a DoD WSUS server to distribute software updates, and the computer is configured to point at that server, this can be set to "Enabled". In this instance, the setting will not be considered a finding.
To determine whether WSUS is being used, verify the following registry key value exists and is pointing to an organizational or DoD WSUS URL:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Policies\Microsoft\Windows\WindowsUpdate\

Value Name: WUServer

Type: REG_SZ
Value: "URL of DoD WSUS"

Fix Text (F-45911r2_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Configure Automatic Updates" to "Disabled". If the site is using a DoD WSUS server to distribute software updates, the policy setting to configure the WSUS URL is Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Specify intranet Microsoft update service location".

Fix Text (F-45911r2_fix)

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Configure Automatic Updates" to "Disabled".

If the site is using a DoD WSUS server to distribute software updates, the policy setting to configure the WSUS URL is Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Specify intranet Microsoft update service location".