UCF STIG Viewer Logo

Root Certificates must not be updated automatically from the Microsoft site.


Overview

Finding ID Version Rule ID IA Controls Severity
V-15671 WN12-CC-000031 SV-53015r1_rule ECSC-1 Low
Description
Root Certificate updates must be controlled in the enterprise to ensure a proper validation chain is maintained. This setting prevents root certificates from being updated automatically from the Microsoft site.
STIG Date
Windows Server 2012 Domain Controller Security Technical Implementation Guide 2014-01-07

Details

Check Text ( C-47322r2_chk )
If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Policies\Microsoft\SystemCertificates\AuthRoot\

Value Name: DisableRootAutoUpdate

Type: REG_DWORD
Value: 1
Fix Text (F-45942r1_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Automatic Root Certificates Update" to "Enabled".