Microsoft Windows Defender Antivirus STIG: WNDF-AV-000030

Check: WNDF-AV-000030 (in versions v2 r2 through v1 r1)

Title

Windows Defender AV must be configured to check for definition updates daily. (Cat II impact)

Discussion

This policy setting allows you to specify the day of the week on which to check for definition updates. The check can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (default) (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never If you enable this setting the check for definition updates will occur at the frequency specified. If you disable or do not configure this setting the check for definition updates will occur at a default frequency.

Check Content

Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Specify the day of the week to check for definition updates" is set to "Enabled" and "Every Day" is selected in the drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Signature Update Criteria: If the value "ScheduleDay" is REG_DWORD = 0, this is not a finding.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Specify the day of the week to check for definition updates" to "Enabled" and select "Every Day" in the drop down box.

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.
Number Definition
CCI-001308

The information system automatically updates spam protection mechanisms.

Controls

Controls tied to check. These are derived from the CCIs shown above.
Number Title
SI-8 (2)

Automatic Updates