WARNING NOTICE

Do not attempt to implement any of the settings without first testing them in a non-operational environment. These recommendations should be applied only to Windows XP Professional SP2 and Vista systems and will not work on Windows 9X/ME, Windows NT, Windows 2000 or Windows Server 2003. The security policies have been tested on Windows XP Professional SP2 and Vista systems with a Windows 2003 server and will not work on Windows 9X/ME, Windows NT, Windows 2000 or Windows Server 2003.

The draft download packages contain recommended security settings; they are not meant to replace well-structured policy or sound judgment. Furthermore, these recommendations do not address site-specific configuration issues. Care must be taken when implementing these settings to address local operational and policy concerns.

These recommendations were developed at the National Institute of Standards and Technology, which collaborated with OMB, DHS, DISA, NSA, USAF, and Microsoft to produce the Windows XP and Vista FDCC baseline. Pursuant to title 17 Section 105 of the United States Code, these recommendations are not subject to copyright protection and are in the public domain. NIST assumes no responsibility whatsoever for their use by other parties, and makes no guarantees, expressed or implied, about their quality, reliability, or any other characteristic. We would appreciate acknowledgement if the recommendations are used.

Download Packages

2008.05.21

Updated the ZIP SCAP file to include April patches.

2008.03.04

Updated the ZIP SCAP file to include February 08 patches.

2008.02.15

Released the 2008 Q1 Revised GPOs, a changelog is included in the compressed file. Also updated the FDCC Documentation, new version is 1-0-2.

2008.01.24

Updated the ZIP SCAP file to include January 08 patches.

2008.01.12
NIST released the updated SCAP content for Windows XP, Vista, XP firewall, Vista firewall, and Internet Explorer 7. The updated content includes additional automated checks and a complete mapping from the CCEs to the NIST 800-53 security contols. The settings that cannot be automated are documented in the readme.txt file included in the ZIP file.

2007.11.17 

Microsoft has corrected the activation issue with the FDCC Vista virtual machine. Please download the updated FDCC Windows Vista ZIP files.

2007.11.10 

NIST is working with Microsoft to resolve the activation issue with the FDCC Vista virtual hard Disk (VHD). It will be posted to the site by the end of the week.

2007.10.31

NIST corrected typos in the FDCC SCAP Documentation Release 1.0.1.

2007.10.30

NIST has updated the Windows Vista and XP documentation to include the revision history and released the SCAP content documentation to reflect the settings that are included in the SCAP data stream.

2007.10.23

NIST has updated the Windows Vista and XP documentation, VHDs, and SCAP content.

2007.08.20
Please read the Download FAQs to resolve issues with downloading, logging on, and activating Windows Vista.

NOTE: This is Archived FDCC Content (access current content here)

Archival VHD content is not available due to space limitations

Updates History

Comments and Questions

Comments and questions may be addressed to fdcc@nist.gov.