Windows 10 systems must use either Group Policy or an approved Mobile Device Management (MDM) product to enforce STIG compliance.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-268319	SRG-OS-000480-GPOS-00227	WN10-CC-000063	SV-268319r1135263_rule	2025-09-24	3

Description
Without Windows 10 systems being managed, devices could be rogue and become targets of an attacker.

ℹ️ Check
Verify the Windows 10 system is receiving policy from either Group Policy or an MDM with the following steps: From a command line or PowerShell: gpresult /R OS Configuration: Member Workstation If the system is not being managed by GPO, ask the administrator to indicate which MDM is managing the device. From PowerShell: Get-Service -Name "IntuneManagementExtension" If the Windows 10 system is not receiving policy from either Group Policy or an MDM, this is a finding. This is NA for standalone, nondomain-joined systems.

ℹ️ Check

Verify the Windows 10 system is receiving policy from either Group Policy or an MDM with the following steps: From a command line or PowerShell: gpresult /R OS Configuration: Member Workstation If the system is not being managed by GPO, ask the administrator to indicate which MDM is managing the device. From PowerShell: Get-Service -Name "IntuneManagementExtension" If the Windows 10 system is not receiving policy from either Group Policy or an MDM, this is a finding. This is NA for standalone, nondomain-joined systems.

✔️ Fix
Configure the Windows 10 system to use either Group Policy or an approved MDM product to enforce STIG compliance.