Title

Automatic Updates must not be used (unless configured to point to a DoD server). (Cat II impact)

Discussion

Uncontrolled system updates can introduce issues to a system. The system must be configured to prevent Automatic Updates from being run unless directed to a DoD Windows Server Update Services (WSUS) server.

Check Content

Fix Text

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Configure Automatic Updates" to "Disabled". If the site is using a DoD WSUS server to distribute software updates, the policy setting to configure the WSUS URL is Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Specify intranet Microsoft update service location".

Additional Identifiers

Rule ID: SV-25200r2_rule

Vulnerability ID: V-14250

Group Title: Configure Automatic Updates

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.