Apply DISA STIGs to Azure Virtual Desktop

Harden an Azure Virtual Desktop session host to DoD security standards.

Introduction

30 Second Summary

Government and defense organizations have some of the strictest security requirements in the world. Every setting on a computer system must meet a specific standard before it is considered safe enough to handle sensitive data.

In this project, you will deploy an Azure Virtual Desktop session host and harden it by applying the official DISA Security Technical Implementation Guide (STIG) for Windows 11. You will then validate your compliance posture using STIG Viewer and export a formal report.

What You'll Build

A STIG-hardened Azure Virtual Desktop session host with a documented compliance posture, proving you can secure cloud-based virtual desktops to DoD security standards.

By the end of this project, you'll have:

A deployed Azure Virtual Desktop host pool with a Windows 11 Enterprise session host joined to Microsoft Entra ID.
The official DISA STIG GPO imported and applied via Local Group Policy on the session host.
A STIG Viewer checklist documenting your compliance status across 258 security findings, with an exported HTML compliance report.
Secret Mission: Manually remediate additional CAT II findings and configure RDP session timeout policies aligned with STIG requirements.

Are there any prerequisites?

You will need an Azure account with an active subscription (Pay-As-You-Go or a free trial with credits). This project costs approximately $5-10 if resources are left running for a few hours. Cleanup instructions are included at the end.

Set Up Your Azure Virtual Desktop Environment

Before you can harden a virtual desktop to DoD security standards, you need the virtual desktop itself. In this step, you will deploy a complete Azure Virtual Desktop environment from scratch inside the Azure Portal.

This includes a networking foundation, a host pool to manage your session host, and a workspace that connects users to their desktops. Once this is done, you will have a running Windows 11 Enterprise VM ready for STIG hardening.

In this step, get ready to:

Create a Resource Group and Virtual Network for your AVD deployment.
Deploy a Personal host pool with a Windows 11 Enterprise session host.
Create a Workspace and assign yourself access to the Desktop Application Group.

Create a Resource Group and Virtual Network

Every Azure deployment needs a Resource Group to hold its resources together. You also need a Virtual Network so your session host VM has network connectivity.

What is a Resource Group?

A Resource Group is a container that holds related Azure resources. When you delete the Resource Group later, all resources inside it are deleted together. This makes cleanup simple.

In the Azure Portal search bar at the top, type Resource groups and select it from the results.
Click Create.
Select your Azure subscription from the Subscription dropdown.
In the Resource group field, enter rg-avd-stig.
For Region, select an Azure region close to you (for example, East US).
Click Review + Create, then click Create.

Your Resource Group is ready in a few seconds. Now create the Virtual Network inside it.

In the Azure Portal search bar, type Virtual networks and select it from the results.
Click Create.
Select your subscription from the Subscription dropdown.
In the Resource group dropdown, select rg-avd-stig.
In the Virtual network name field, enter vnet-avd-stig.
For Region, select the same region you chose for the Resource Group.
Leave the default IP address settings (the portal will configure a default subnet for you).
Click Review + Create, then click Create.

Wait for the deployment to complete. You should see a notification that says your Virtual Network was successfully deployed.

Not seeing your Virtual Network?

Make sure you selected the same region for both the Resource Group and the Virtual Network. Also confirm that rg-avd-stig is selected in the Resource group dropdown when creating the VNet.

Help me troubleshoot my Azure Virtual Network creation

Create an Azure Virtual Desktop Host Pool

A host pool is a collection of virtual machines that serve as session hosts in Azure Virtual Desktop. You will create a Personal host pool, which assigns one dedicated VM to each user.

Why a Personal host pool?

Personal host pools give each user a 1:1 mapping to a single VM. This is simpler for a STIG hardening project because you are working directly on one machine without multi-session complexity.

Pooled host pools share VMs across multiple users and are better suited for production scaling.

This step creates a billable VM

The session host VM (Standard_D2s_v3) costs approximately $0.096/hr in the East US region. Make sure to deallocate or delete resources when you are finished with the project to avoid unnecessary charges.

In the Azure Portal search bar, type Azure Virtual Desktop and select the matching service entry.
Select Host pools in the left menu, then click Create.
On the Basics tab, select your subscription.
In the Resource group dropdown, select rg-avd-stig.
Enter a name for your host pool in the Host pool name field (for example, hp-avd-stig).
For Location, select the same region you used for your Resource Group.
Set Validation environment to No.
For Preferred app group type, select Desktop.
For Host pool type, select Personal.
Click Next: Virtual Machines.

Now configure your session host VM on the Virtual Machines tab.

Set Add virtual machines to Yes.
In the Resource group dropdown, confirm rg-avd-stig is selected.
For Number of VMs, enter 1.
For Image, click See all images and search for Windows 11 Enterprise. Select the latest Gen2 image from the Microsoft marketplace.
For Virtual machine size, select Standard_D2s_v3 (2 vCPUs, 8 GB RAM).
Enter a username and password for the local administrator account on the VM. Remember these credentials as you will need them to log in later.
Under Virtual network, select vnet-avd-stig.
Leave the Subnet set to the default subnet.
Under Domain to join, select Microsoft Entra ID.
Check the box for Intune enrollment if prompted (optional, you can leave it unchecked).
Click Next: Workspace.

Why Microsoft Entra ID join?

Microsoft Entra ID join (formerly Azure AD join) allows your session host to authenticate users without needing a traditional Active Directory domain controller. This simplifies the setup significantly for a learning environment.

Skip the Workspace tab for now (you will create it manually in the next substep). Leave Register desktop app group set to No.

Click Review + Create.
Review your settings, then click Create.

How long does deployment take?

The host pool and session host VM deployment typically takes 10-20 minutes. Azure needs to provision the VM, install the AVD agent, and register the session host with your host pool. You can continue to the next substep while it deploys.

Deployment failed or quota error?

If you see a quota error, your subscription may not have enough vCPU quota for the Standard_D2s_v3 size in your chosen region. Try selecting a different region or request a quota increase from the Azure Portal under Subscriptions > Usage + quotas.

Help me fix my Azure Virtual Desktop host pool deployment failure

Create a Workspace and Application Group

A Workspace is what users see when they open the Remote Desktop client or Windows App. It displays the desktops and apps available to them through Application Groups.

In the Azure Portal search bar, type Azure Virtual Desktop and select it.
Select Workspaces in the left menu, then click Create.
Select your subscription and choose rg-avd-stig as the Resource Group.
In the Workspace name field, enter ws-avd-stig.
For Location, select the same region as your host pool.
Click Next: Application groups.
Click + Register application groups.
Find and select the Desktop Application Group that was automatically created with your host pool (it will be listed under your host pool name).
Click Select.
Click Review + Create, then click Create.

Now assign yourself access to the Desktop Application Group so you can connect to the session host.

Navigate back to Azure Virtual Desktop > Application groups.
Click on the Desktop Application Group associated with your host pool.
Select Assignments in the left menu.
Click + Add.
Search for your user account (the one you are signed in with) and select it.
Click Select to confirm the assignment.

Navigate back to your host pool and select Session hosts. Confirm that your session host shows a status of Available. If it still shows as deploying, wait a few more minutes and refresh the page.

Session host stuck on Unavailable?

If your session host shows Unavailable after 20 minutes, it may be a registration issue. Check that the Microsoft.DesktopVirtualization resource provider is registered on your subscription. Go to Subscriptions > your subscription > Resource providers and search for it.

Help me troubleshoot my session host availability status

Your Azure Virtual Desktop environment is fully deployed. Next up, you will connect to your session host and download the DISA STIG resources needed to harden it.

Connect to Your Session Host and Prepare for STIG Application

Your AVD environment is deployed and your session host is running. Now you need to get inside that session host and load it up with the DISA security resources you will use to harden it.

In this step, you will RDP into your Windows 11 session host and download three critical resources from the DoD Cyber Exchange. These are the official STIG benchmark, the pre-built GPO package, and the STIG Viewer tool for assessing compliance.

In this step, get ready to:

Connect to your AVD session host via RDP.
Download the Windows 11 STIG and GPO package from the DoD Cyber Exchange.
Install and launch STIG Viewer 3.x on the session host.

Connect to your session host

Your session host is a Windows 11 VM running inside your host pool. To work on it directly, you need to establish a Remote Desktop connection.

In the Azure Portal, type Azure Virtual Desktop in the search bar and select the matching service entry.
Select Host pools from the left menu.
Click your host pool name to open it.
Select Session hosts in the left panel.
Click the name of your session host VM to open its details.
Click Connect at the top of the page and choose Connect via RDP.
Download the .rdp file and open it with the Remote Desktop client on your local machine.
Sign in with the same credentials you configured when creating the session host (your Microsoft Entra ID account).

What is RDP?

Remote Desktop Protocol (RDP) lets you control a remote Windows machine as if you were sitting in front of it. Azure Virtual Desktop uses a reverse-connect transport over HTTPS, so the session host never exposes inbound ports directly.

Alternative connection method

You can also connect through the Windows App or the Remote Desktop client by subscribing to your AVD workspace feed. Open the client, add a workspace using your Entra ID credentials, and double-click the Desktop resource that appears.

Once connected, you should see the Windows 11 desktop of your session host. You are now working inside the VM.

Connection failing?

Make sure the session host shows a status of Available in the Azure Portal's session hosts list. If it shows Unavailable, the VM may still be starting up. Wait a few minutes and refresh.

If you receive a certificate warning when connecting, this is expected. Azure Virtual Desktop uses a self-generated certificate by default. Accept the warning to proceed.

Why can't I connect to my AVD session host?

Download the DISA STIG resources onto the session host

DISA publishes all STIGs and supporting tools on the DoD Cyber Exchange. You need two ZIP files: the Windows 11 STIG itself (the rules) and the GPO package (pre-configured policy settings that implement many of those rules automatically).

On the session host, open Microsoft Edge from the taskbar.
Navigate to the STIG downloads page:

https://public.cyber.mil/stigs/downloads/

Search or scroll to find Microsoft Windows 11 STIG - Ver 2, Rel 3 and download the ZIP file.
Next, navigate to the GPO page:

https://public.cyber.mil/stigs/gpo/

Download the Group Policy Objects (GPOs) - April 2025 ZIP file.
Save both files to the Downloads folder on the session host.

What are these two downloads?

The STIG ZIP contains the XCCDF benchmark file. This is a machine-readable checklist of 258 security findings (28 CAT I, 213 CAT II, 17 CAT III) that defines what a compliant Windows 11 system should look like.

The GPO package contains pre-built Group Policy backups that automatically configure many of those 258 settings. Instead of manually editing each policy, you import the GPO and it handles hundreds of settings at once.

Download not starting?

The DoD Cyber Exchange does not require a CAC (Common Access Card) for the public STIG downloads. If Edge is blocking the download, click the three-dot menu in the download bar and select Keep or Keep anyway.

Help me download files from the DoD Cyber Exchange on my session host.

Download and install STIG Viewer 3.x

STIG Viewer is the official DISA tool for loading STIGs, creating checklists, and documenting your compliance assessment. You will use it in the next steps to evaluate your session host against every finding.

In Edge, navigate to the SRG/STIG tools page:

https://public.cyber.mil/stigs/srg-stig-tools/

Find and click STIG Viewer 3.x-Win64 to download the standalone ZIP file.
Open File Explorer and create the folder C:\Tools\STIGViewer.
Extract the full contents of the downloaded ZIP file into C:\Tools\STIGViewer.

Why extract to a dedicated folder?

STIG Viewer is a standalone application. It does not have an installer. You run it directly from the extracted folder, so placing it in a known location like C:\Tools\STIGViewer keeps things organized for the rest of this project.

Windows marks files downloaded from the internet as blocked, which can prevent STIG Viewer from running. You need to unblock the files before launching.

In File Explorer, navigate to C:\Tools\STIGViewer.
Right-click the STIG Viewer 3.exe file and select Properties.
On the General tab, look for the Security section at the bottom.
Check the Unblock checkbox and click OK.

Unblock all files at once with PowerShell

Instead of unblocking files one by one, you can open PowerShell as Administrator on the session host and run the following command to unblock everything in the folder:

Get-ChildItem -Path "C:\Tools\STIGViewer" -Recurse | Unblock-File

This uses the Unblock-File cmdlet on every file in the extracted folder.

Double-click STIG Viewer 3.exe to launch the application.

STIG Viewer opens to its Home page. You should see the application window with options to add STIGs, create checklists, and manage your library.

STIG Viewer not launching?

If you see a SmartScreen warning, click More info and then Run anyway. This is expected because STIG Viewer is not code-signed by a commercial certificate authority.

If nothing happens at all when you double-click the exe, make sure you unblocked the files. Go back to the Properties step above or use the PowerShell command.

Help me get STIG Viewer running on my Windows session host.

Your session host is now loaded with everything you need. Next up, you will extract the GPO package and apply it to lock down your Windows 11 system to DISA standards.

Import and Apply the DISA STIG GPO

You have all the STIG resources downloaded onto your session host. Now it is time to actually harden the machine.

In this step, you will extract the GPO package, use the LGPO.exe tool to import the STIG settings into your session host's Local Group Policy, and then verify that the settings took effect.

In this step, get ready to:

Extract the DISA GPO package and locate the Windows 11 GPO backup.
Import the STIG GPO into Local Group Policy using LGPO.exe.
Verify the policy application through the Local Group Policy Editor and gpresult.

Extract the GPO package

The DISA GPO package is a ZIP file containing pre-configured Group Policy Object backups for each applicable STIG. You need to extract it to a working directory so you can point the import tool at the correct folder.

On your session host, open File Explorer.
Navigate to the folder where you downloaded the "Group Policy Objects (GPOs) - April 2025" ZIP file (likely your Downloads folder).
Right-click the ZIP file and select Extract All.
Set the destination to C:\Temp\STIG-GPOs and click Extract.
Open the extracted C:\Temp\STIG-GPOs folder and browse through the subfolders.
Locate the Windows 11 GPO folder inside the extracted contents.
Inside the Windows 11 folder, you will see a GUID-named subfolder containing the GPO backup files (including backup.xml and a DomainSysvol folder).

What is a GPO backup folder?

A GPO backup folder contains the exported policy settings from a domain Group Policy Object. It includes registry-based policies, security templates, and audit configuration files.

DISA packages these backups so you can apply them to standalone or Entra-joined machines that are not connected to a traditional Active Directory domain.

Also locate LGPO.exe

The DISA GPO download historically includes LGPO.exe somewhere in the extracted contents. Browse through the extracted folders and find it. If it is not included, you can download it separately from the Microsoft Security Compliance Toolkit.

Import the GPO using Local Group Policy

LGPO.exe is a command-line utility from Microsoft that imports GPO backup settings directly into a machine's Local Group Policy. This is how you apply DISA's pre-configured security settings to a standalone or Entra-joined machine that does not belong to a traditional Active Directory domain.

Open PowerShell as Administrator by pressing the Windows key, typing PowerShell, right-clicking Windows PowerShell, and selecting Run as administrator.
Navigate to the folder where LGPO.exe is located by running this command (adjust the path if you found it in a different location):

cd C:\Temp\STIG-GPOs

Apply the Windows 11 STIG GPO backup to your local machine by running this command:

# Import GPO backups from the Windows 11 STIG folder into Local Group Policy
.\LGPO.exe /g C:\Temp\STIG-GPOs

What does this command do?

The /g flag tells LGPO.exe to import settings from one or more GPO backups found under the specified path. It reads the Computer Configuration and User Configuration settings from the backup and writes them into the local machine's Group Policy store.

After the import completes, these settings are enforced just as if they came from a domain-level Group Policy.

You should see output indicating that LGPO.exe is processing registry-based policies, security templates, and audit settings. Wait for the command to complete.

Seeing 'access denied' or the command fails?

Make sure you launched PowerShell as Administrator. LGPO.exe requires elevated privileges to write to the Local Group Policy store.

If Windows blocks execution because the file was downloaded from the internet, right-click LGPO.exe, select Properties, check Unblock under the Security section, and click OK.

Help me troubleshoot LGPO.exe errors on my session host.

Verify the GPO application

After importing the GPO, you need to confirm that the STIG settings are now active on your session host. You will check two places: the Local Group Policy Editor for a visual confirmation and the gpresult command for a technical confirmation.

Open the Local Group Policy Editor by pressing the Windows key, typing gpedit.msc, and pressing Enter.
In the left pane, expand Computer Configuration.
Expand Windows Settings, then expand Security Settings.
Click on Account Policies, then click Password Policy.
Confirm you see STIG-aligned values such as a minimum password length of 14 characters and password history of 24 passwords.
Browse to Local Policies and then Audit Policy to confirm that auditing settings have been populated.

What should I see?

The Security Settings sections should now show non-default values that match DISA's hardening requirements. If you see default values (such as a minimum password length of 0), the GPO import did not apply correctly.

Confirm policy application from the command line by running this in your elevated PowerShell window:

gpresult /r

What does gpresult /r show?

The gpresult /r command displays a summary of the Group Policy settings applied to the computer and the current user. Look for the "Applied Group Policy Objects" section in the output.

On a standalone or Entra-joined machine with LGPO-applied policies, you will see confirmation that Local Group Policy settings are in effect.

You should see output indicating that the local policy has been applied. The Computer Settings section confirms the applied policy source.

Settings not showing up in gpedit.msc?

Try running gpupdate /force in your elevated PowerShell window to force a policy refresh. Then reopen gpedit.msc and check again.

If values still appear as defaults, confirm that you pointed LGPO.exe /g at the correct path containing the GUID-named backup folder with backup.xml inside it.

Help me verify that my STIG GPO was applied correctly.

Your session host now has the DISA Windows 11 STIG GPO applied to its Local Group Policy. Next up, you will use STIG Viewer to systematically validate each security finding against your hardened machine.

Validate Compliance with STIG Viewer

Your session host now has the DISA GPO applied, which means hundreds of security settings are configured. But applying a GPO and proving compliance are two different things.

In this step, you will use STIG Viewer to systematically assess your session host against the Windows 11 STIG. You will create a formal checklist, evaluate each CAT I finding, and document VDI-specific exemptions that apply to Azure Virtual Desktop.

In this step, get ready to:

Load the Windows 11 STIG V2R3 into the STIG Viewer library.
Create a compliance checklist and begin assessing CAT I findings.
Document VDI-specific exemptions with justification from the STIG check text.

Load the Windows 11 STIG into STIG Viewer

STIG Viewer needs the XCCDF XML file from your downloaded STIG package loaded into its library before you can create a checklist.

In STIG Viewer 3.x, click the magnifying glass icon in the upper-right area of the screen to open the STIG Explorer.
Click Add STIG to Library in the upper portion of the screen.
Navigate to where you extracted the Windows 11 STIG V2R3 ZIP file on your session host.
Select the XCCDF XML file (.xml format) from the extracted folder.
Click Load.

What is XCCDF?

XCCDF (Extensible Configuration Checklist Description Format) is a standard XML format for expressing security checklists. DISA publishes every STIG in this format so that tools like STIG Viewer can parse the rules, severities, and check procedures programmatically.

Confirm the Windows 11 STIG appears in your STIG library. You should see its name listed with the total number of rules (258 findings).

STIG not appearing after import?

Make sure you selected the .xml file, not the parent ZIP. STIG Viewer can import ZIP files directly, but if the ZIP is nested inside another ZIP you may need to extract it first.

If the file appears greyed out, right-click it in File Explorer, select Properties, and check Unblock under Security. Then try the import again.

Why can't STIG Viewer load my XML file?

Create a checklist and begin assessment

A checklist in STIG Viewer is your formal record of each finding's status. You will create one for your session host and begin evaluating the 28 CAT I (High severity) findings.

Click the checklist icon (represented by three lines and a checkmark) at the top of the STIG Viewer screen.
Click Create Checklist.
When prompted for a name, type AVD-SessionHost-01 and click Create Checklist.
In the left pane, find the Windows 11 STIG you just loaded. Click the + beside the STIG name to add all rules to the checklist.
Click Fill Checklist in the upper-right corner to process the checklist.

What does Fill Checklist do?

Fill Checklist builds the full assessment workspace. You will see tabs for combined severities and individual tabs for CAT I, CAT II, and CAT III findings. Each finding displays its check procedure, fix text, and a status field you update during assessment.

As you update statuses, STIG Viewer recalculates the checklist score automatically based on rule status and weight.

Click the CAT I severity tab to filter the view to only the 28 High severity findings.
For each CAT I finding, read the Check Text and evaluate it against your session host.
If the GPO resolved the finding (the configured setting matches the STIG requirement), set the status to Not a Finding.
If the finding does not apply to your VDI environment, set the status to Not Applicable (covered in the next substep).
If the finding is not yet resolved, leave the status as Open.

What do the three statuses mean?

Not a Finding means your system meets the STIG requirement. The control is implemented correctly.
Open means the system does not meet the requirement. This is a vulnerability that needs remediation or a documented risk acceptance.
Not Applicable means the requirement does not apply to your specific system type or deployment. VDI environments have several of these.

Click Save in the upper-right corner to save your progress.
Confirm the checklist appears on the STIG Viewer homepage under the Checklists section.

Not sure whether a finding is resolved by the GPO?

Open gpedit.msc and navigate to the policy path described in the Check Text. Compare the configured value against what the STIG requires. If they match, the GPO resolved it.

Help me determine whether a specific STIG finding was resolved by the GPO

Document VDI-specific exemptions

Several STIG findings are explicitly marked as Not Applicable for virtual desktop environments. The STIG check text itself provides the justification. You need to document these properly so your compliance report reflects accurate results.

In your AVD-SessionHost-01 checklist, locate the following CAT I findings and set each to Not Applicable:

V-253255 (TPM requirement). Justification: "For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA."
V-253257 (Secure Boot). Justification: "For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA."
V-253260 (BitLocker pre-boot PIN). This is NA for VDI environments because the virtual desktop does not use physical pre-boot authentication.
V-253295 (24-hour nonpersistent VM session requirement). Justification: "For Azure Virtual Desktop (AVD) implementations with no data at rest, this is Not Applicable."

For each of these findings, paste the justification text into the Comments or Finding Details field so your compliance report includes the rationale.
Click Save to update the checklist.

Why do VDI environments get these exemptions?

DISA recognizes that virtual desktop instances running in the cloud cannot implement hardware-level controls like TPM chips or Secure Boot the same way physical machines can. Azure VMs do not have physical TPM hardware accessible to the guest OS.

Similarly, the 24-hour session limit for nonpersistent VMs is designed to prevent data accumulation. AVD session hosts with no data at rest already satisfy the intent of the control, making the specific implementation requirement unnecessary.

Review your CAT I tab. You should now see a mix of statuses: most findings marked Not a Finding (resolved by the GPO), four findings marked Not Applicable (VDI exemptions), and possibly a few remaining as Open.

Document everything

In real-world STIG assessments, auditors expect written justification for every Not Applicable and Not a Finding status. Get in the habit of adding comments to each finding explaining how you verified the control. This documentation is what separates a completed checklist from a trustworthy one.

Your compliance checklist is taking shape. Next up, you will export this work as a formal compliance report that you can share with stakeholders or auditors.

Export Your Compliance Report

In Step 4 you assessed your session host against the Windows 11 STIG and documented the status of each CAT I finding in your checklist.

Now it is time to finalize your assessment and export it as a formal compliance report. These exports are what you would hand to an auditor, attach to an Authority to Operate (ATO) package, or archive as evidence of your hardening work.

In this step, get ready to:

Finalize all 28 CAT I findings in your STIG Viewer checklist.
Export your checklist as a CKL file and an HTML compliance report.

Complete the CAT I assessment

Before exporting, do a final pass through all 28 CAT I findings to make sure every item has a clear status and proper documentation.

In STIG Viewer, open your AVD-SessionHost-01 checklist.
Sort the findings by severity so that all CAT I items appear together at the top.
Walk through each of the 28 CAT I findings and confirm it has one of these statuses assigned:

Not a Finding for items that the STIG GPO resolved.
Not Applicable for VDI-specific exemptions (V-253255, V-253257, V-253260, V-253295). Each of these should include a justification comment referencing the STIG check text.
Open for any remaining items that are non-compliant and could not be resolved by the GPO.

For any item still showing as unreviewed, click the finding and assign the correct status based on your assessment from the previous step.
Add a brief comment to each finding explaining your rationale (e.g., "Resolved by DISA STIG GPO April 2025" or "NA per STIG check text for AVD environments").

Why document comments on each finding?

In a real compliance workflow, auditors and assessors need to understand why each control passed or was marked as an exemption. A bare status without explanation will be sent back for additional documentation.

Adding comments now builds the habit of writing defensible justifications that hold up under review.

Sort by status to find gaps

If you are unsure whether any findings are missing a status, try filtering by "Not Reviewed" in the checklist panel. Any items that appear have not been assessed yet and need attention before export.

Export the checklist

With all 28 CAT I findings finalized, you are ready to export your compliance evidence. You will save two formats: a CKL file for machine-readable archival and an HTML report for human-readable review.

Create the output folder by opening a PowerShell window on your session host and running this command:

mkdir C:\STIG-Reports

What does this command do?

This creates a C:\STIG-Reports\ folder on your session host where you will save both export files.

Confirm the folder exists by running:

ls C:\STIG-Reports

You should see an empty directory listed with no errors.

Switch back to STIG Viewer and make sure your AVD-SessionHost-01 checklist is open.
Click the Export icon in the checklist toolbar.
In the export pop-up window, select CKL as the format.
Leave all fields selected (the default).
Click Export.
In the file browser that opens, navigate to C:\STIG-Reports\ and save the file.

What is a CKL file?

CKL is the standard checklist format used across DoD compliance workflows. It is an XML-based file that can be imported into other tools like eMASS (Enterprise Mission Assurance Support Service) for official accreditation tracking.

Click the Export icon again to open the export pop-up a second time.
This time, select HTML as the format.
Leave all fields selected.
Click Export and save the file to C:\STIG-Reports\.

Verify both files exist by running this in PowerShell:

ls C:\STIG-Reports

You should see two files listed: one with a .ckl extension and one with a .html extension.

Open the HTML report by double-clicking it in File Explorer, or by running:

Start-Process C:\STIG-Reports\*.html

Your browser opens with a formatted compliance report showing every assessed finding, its severity, status, and your comments.

What can I do with these exports?

The CKL file is your machine-readable evidence. Import it into eMASS, share it with your security team, or archive it for future audits.

The HTML report is your human-readable snapshot. Share it with stakeholders who need to see your compliance posture at a glance without installing STIG Viewer.

Don't see both files in C:\STIG-Reports?

Make sure you navigated to C:\STIG-Reports\ in the file browser during each export. If you accidentally saved to a different location, check your Downloads folder or Desktop.

If the export button was grayed out, ensure your checklist has at least one finding with a status assigned. An entirely empty checklist cannot be exported.

Help me find my exported files

Secret mission

Harden Beyond the GPO

The DISA GPO covers many settings automatically, but not all 258 STIG findings are automatable via Group Policy. Your mission is to go further. Identify 5 CAT II findings still marked Open, manually remediate them using the Fix Text instructions, configure RDP session timeout policies, and export an updated compliance report showing your improved security posture.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. The session host VM incurs compute charges for every hour it runs, so make sure you choose an option below before closing the Azure Portal.

Cost warning

Your session host VM (Standard_D2s_v3) costs approximately $0.10 per hour while running. If you leave it running overnight or over a weekend, charges add up quickly. Deallocating the VM stops compute billing but the OS disk still incurs a small storage charge.

If you are done with this project, delete the entire resource group to stop all charges immediately.

Resources you used:

Azure Resource Group rg-avd-stig (contains all other resources).
Session host VM (Standard_D2s_v3, Windows 11 Enterprise).
Virtual Network vnet-avd-stig with default subnet.
AVD Host Pool (Personal, 1 session host).
AVD Workspace ws-avd-stig.
Desktop Application Group.

Keep everything running

No action needed. Choose this if you are still actively building or plan to continue hardening the session host in the next few hours.

Your VM continues to run and incur hourly compute charges.
All STIG configurations, checklist files, and exports remain in place on the session host.
Monitor your costs in the Azure Portal under Cost Management + Billing.

Pause - I'll come back to this later

Deallocate the session host VM to stop compute billing while keeping all your files and configurations intact. You can restart the VM later and pick up where you left off.

In the Azure Portal, search for Virtual machines and select your session host VM.
On the VM's Overview page, click Stop in the command bar.
Confirm the deallocation when prompted.
Wait until the VM status shows Stopped (deallocated). Compute billing stops at this point.

What about storage charges?

The OS disk attached to your deallocated VM still incurs a small daily storage charge. This is minimal compared to compute costs, but keep it in mind if you leave the VM paused for weeks.

Delete - I don't want to use this again

Remove all project resources and stop all charges by deleting the entire resource group. This is irreversible.

In the Azure Portal, search for Resource groups and select rg-avd-stig.
Click Delete resource group at the top of the page.
Type rg-avd-stig in the confirmation field to confirm the deletion.
Click Delete.
Wait for the notification confirming the resource group has been deleted. This removes the VM, virtual network, host pool, workspace, application group, and all associated disks.

How long does deletion take?

Deleting a resource group with a VM typically takes 5-10 minutes. Azure deletes dependencies in the correct order automatically.

Nice Work!

You just STIG-hardened an Azure Virtual Desktop session host to DoD security standards. You now have hands-on experience with the exact compliance workflow used by government and defense organizations to secure Windows systems in the cloud.

You've learned how to:

Deploy a complete Azure Virtual Desktop environment with a Windows 11 Enterprise session host joined to Microsoft Entra ID.
Download and apply the official DISA Windows 11 STIG GPO package to harden a session host using Local Group Policy.
Use STIG Viewer 3.x to assess compliance against 258 security findings, document VDI-specific exemptions, and export a formal compliance report.
Secret Mission: Manually remediate additional CAT II findings beyond the GPO and configure RDP session timeout policies aligned with STIG requirements.

Ready to quiz yourself?