[BESAdmin-Announcements] BigFix Compliance: Updated Universal Checklist for Windows Workstation Beta, published 2026-09-21

[Announcements for BES Administrators]

*Product: * BigFix Compliance


*Title: *Updated Universal Checklist for Windows Workstation (Beta) to
support more recent versions of CIS and DISA benchmarks.

*Note: The Universal Checklist for Windows Workstation remains in Beta.
This release updates the Beta content with the latest benchmark coverage.*

New to the Universal Checklist for Windows Workstation? See the original
Beta announcement here:
https://forum.bigfix.com/t/announcing-the-beta-release-universal-checklist-for-windows-workstation/53163


*Published Sites: * Universal Checklist for Windows Workstation, site
version 3
 (The site version is provided for air-gap customers.)

*Details: Universal Checklist for Windows Workstation (Beta)*

●       Total Fixlets: 657

●       Total New Fixlets: 2

●       Total Updated Fixlets: 14

●       Total Deleted Fixlets: 1

●       Fixlets with Remediation: 632

●       Parameterized Fixlets: 532

●       Benchmark Sources: CIS and DISA STIGs

●       Applies To: Windows Workstation 10 & 11

ADDED

●       All Wi-Fi Direct adapters must be disabled on the system.

●       Bluetooth must be turned off unless approved by the organization.


REMOVED

●       Ensure 'Password Settings: Password Complexity' is set to 'Enabled:
Large letters + small letters + numbers + special characters' (extra fixlet)



UPDATED

●       Ensure 'Password Settings: Password Complexity' is set to 'Enabled:
Large letters + small letters + numbers + specials' or higher

●       Ensure 'Set time limit for active but idle Remote Desktop Services
sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)'

●       Ensure 'Enable OneSettings Auditing' is set to 'Enabled'

●       The US DoW CCEB Interoperability Root CA cross-certificates must be
installed in the Untrusted Certificates Store on unclassified systems.

●       The DoW Interoperability Root CA cross-certificates must be
installed in the Untrusted Certificates Store on unclassified systems.

●       The DoW Root CA certificates must be installed in the Trusted Root
Store.

●       The use of a hardware security device with Windows Hello for
Business must be enabled.

●       Configure 'Interactive logon: Message text for users attempting to
log on'

●       Ensure 'Set time limit for disconnected sessions' is set to
'Enabled: 1 minute'

●       Windows Workstation must be configured to audit file system
failures.

●       Windows Workstation must be configured to audit file system
successes.

●       Windows Workstation must be configured to audit handle manipulation
successes.

●       Windows Workstation must be configured to require a minimum pin
length of six characters or greater.

●       The Windows PowerShell 2.0 feature must be disabled on the system.



*Actions to take:*

●       To subscribe to the above site, you can use the License Overview
Dashboard to enable and gather the site. Note that you must be entitled to
the BigFix Compliance product, and you must be using BigFix version 10 and
later.

●       If you use custom sites, update your custom sites accordingly to
use the latest content. You can synchronize your content by using the
Synchronize Custom Checks wizard. For more information, see
<https://help.hcltechsw.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html>Using
the Synchronize Custom Checks wizard
<https://help.hcltechsw.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html>
.


*More information: * To know more about the BigFix Compliance SCM
checklists, please see the following resources:

●       BigFix Forum:
<https://forum.bigfix.com/c/release-announcements/compliance>
https://forum.bigfix.com/c/release-announcements/compliance

●       BigFix Compliance SCM Checklists:
<https://forum.bigfix.com/t/universal-compliance-checklist/54703>
https://forum.bigfix.com/t/universal-compliance-checklist/54703

We hope you find this latest release of SCM content useful and effective.
Thank you.

*– The BigFix Compliance team*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260922/5502de23/attachment.html>